A0Backdoor Campaign Abuses Microsoft Teams and Quick Assist for Initial Access

BlueVoyant researchers identified a social-engineering campaign in which operators linked to Blitz Brigantine / Storm-1811 / STAC5777, a cluster associated with the Black Basta ecosystem, impersonate IT support over Microsoft Teams after overwhelming targets with spam email. Victims are persuaded to launch Quick Assist, giving the attackers remote access that is then used to deploy A0Backdoor through digitally signed MSI packages masquerading as legitimate Microsoft software such as Microsoft Teams and CrossDeviceService. The activity has targeted organizations in sectors including finance and healthcare, and the use of multiple code-signing certificates suggests the operators prepared the toolchain well before the observed intrusions.

Once installed, A0Backdoor fingerprints the host and communicates with operators using DNS tunneling over public resolvers, helping the malware blend into normal traffic while maintaining persistence and command-and-control. The reporting is substantive threat intelligence rather than promotional or advisory content, and the only other mention of the same event is a newsletter item that cites the A0Backdoor research as one entry among many malware stories. Other references in the set cover unrelated vulnerabilities, policy developments, AI security issues, phishing, ransomware trends, and separate malware campaigns, and do not describe this specific Teams-and-Quick-Assist intrusion chain.