Attackers Abuse Microsoft Teams External Chat for Remote Access and Ransomware Intrusions

Arctic Wolf Labs analyzed more than 400 incidents in which attackers abused Microsoft Teams external chat to impersonate IT support, deliver malicious files, or persuade users to grant remote access. The attacks exploit legitimate, default-enabled federation capabilities rather than a known Teams vulnerability, often combining email bombing, deceptive display names, and voice calls with Microsoft Quick Assist or other remote-access tools. Attackers increasingly use custom domains, and customer-reported attack chains reached payload execution within 15 minutes of victim engagement. One observed chain deployed an MSI package, obfuscated PowerShell, and a Python implant to enumerate Active Directory and send results to command-and-control infrastructure.

Trend Micro separately documented Black Basta and Cactus ransomware intrusions using email bombing, Teams impersonation, and Quick Assist abuse before deploying BackConnect malware for persistence, command execution, and data exfiltration. Attackers reassembled split payloads into a ZIP archive and used a legitimate OneDrive updater to side-load malicious DLLs. In the Cactus case, attackers also moved laterally through SMB and WinRM and compromised ESXi hosts. Shared infrastructure and leaked Black Basta chats suggested operational overlap or personnel migration between the groups, without establishing attribution for Arctic Wolf’s broader incident set. Defensive priorities include restricting Teams federation to trusted domains, correlating ChatCreated events with endpoint and identity activity, controlling remote-access software, and independently verifying unsolicited IT-support requests.