Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

1. Executive summary

Microsoft Threat Intelligence reports a human-operated intrusion campaign in which threat actors abuse Microsoft Teams external collaboration to impersonate IT/helpdesk personnel and socially engineer users into granting an interactive remote session. Once control is established via legitimate remote-support tooling, the operator uses PowerShell to silently install a malicious MSI (msiexec /qn) that stages a portable, legitimately signed Node.js runtime plus an encrypted JavaScript implant in the user's LocalAppData, providing persistent command execution and HTTPS long-poll C2. Post-implant activity is a full hands-on-keyboard playbook: host and Active Directory reconnaissance, periodic Base64-encoded screenshot capture, follow-on DLL payloads via rundll32, and WinRM (TCP 5985) lateral movement toward domain controllers and certificate authorities — activity consistent with pre-ransomware staging. No CVE is involved; this is social engineering abusing legitimate features, which makes it largely invisible to vulnerability-driven defences. EMEA financial services clients running Teams external chat/calling and permissive WinRM are directly exposed; the initial-access pathway is a user clicking "accept," not an exploitable bug.

2. Regulatory framing

No specific DORA/NIS2 article is engaged beyond the above; the item is a threat campaign, not a breach of a named client, so Art. 19 / NIS2 Art. 23 reporting triggers only if a client confirms compromise in their own environment.

3. Technical analysis & attack chain

Confirmed attack chain (per Microsoft Threat Intelligence, 2026-09-02)

1. Initial access (T1566.003). Threat actor operating from a separate Teams tenant initiates external chat/call impersonating IT or helpdesk staff. Teams presents external-tenant labelling, Accept/Block prompts, message previews and phishing indicators; the attack depends on the user overriding these. Lures observed: "Microsoft Security Update," "Spam Filter Update," "Account Verification," or urgent tasks to "stop deactivation of an account." Vishing is sometimes layered to build trust and keep malicious instructions/URLs out of chat logs. Microsoft explicitly states this is not a Teams vulnerability — it is abuse of legitimate collaboration features.
2. Remote session. User is guided to grant interactive control — approving a "request control" prompt during a Teams screen-share, or opening Quick Assist and reading back the connection code, or opening a remote-assistance application and entering a short key. The detection signal is a remote-assist process tree followed immediately by cmd.exe or PowerShell on the same desktop.
3. MSI delivery and silent install (T1059.001, T1218.007). PowerShell in the remote session downloads a malicious MSI from actor-controlled cloud storage (Azure Blob endpoints, see §5) and installs it silently with /qn — no installer UI shown to the victim. Installer names are update-themed: "devfix," "Hotfix."
4. Staging (T1105). The MSI pulls a portable Node.js runtime from the official Node.js distribution and extracts it into a randomly named directory under the user's LocalAppData. Signed, trusted binary — evades unsigned-executable controls. The MSI also installs a script-based loader plus a separate encrypted implant file (packaged inside the MSI, not downloaded separately) in LocalAppData.
5. Deferred execution. The MSI schedules a deferred, asynchronous custom action that starts hidden bootstrap code via PowerShell, cmd.exe, or WScript, then launches Node.js from LocalAppData. The loader decrypts the high-entropy payload and feeds the resulting JavaScript to Node.js either via standard input or by writing a temporary .js file. Loaders and encrypted payloads use nonstandard extensions: .tmp, .ini, .dat, .bin, .cfg. Renamed copies of node.exe (original metadata still identifying Node.js) were observed.
6. Persistence. Per-user, update-themed: either an HKEY_CURRENT_USER Run value or a shortcut in the user's Startup folder — both named EdgeUpdate — launching the Node.js loader from LocalAppData at sign-in. The Startup-folder variant launches WScript with the staged JScript wrapper, portable Node.js runtime, and nonstandard-extension loader; the Run-key variant invokes the portable Node.js runtime directly.
7. C2 (T1071.001). Randomized HTTPS long-polling. C2 responses are treated as JavaScript source and executed dynamically with access to Node.js module loading, process execution, environment variables, buffers, and the file system. Recovered builds contained dormant logic to query an Ethereum smart contract for an updated C2 URL (contract stores only a URL string); this was disabled, with a hard-coded fallback server used instead.
8. Host reconnaissance (T1082, T1016, T1518.001). C2 tasking launches short-lived cmd.exe/PowerShell bursts: hardware/locale details, disk information, systeminfo, MachineGuid, ProductName, net session, net use, domain membership, antivirus enumeration via SecurityCenter2. Display-adapter-name and AV queries are characteristic sandbox/analysis-environment checks (T1497.001).
9. Screen capture (T1113). Operators repeatedly capture the victim's screen, resize at varying scale factors, Base64-encode, write to a temporary file, then exfiltrate.
10. AD reconnaissance (T1087.002, T1018). Native commands enumerate specific domain accounts (net user /domain); ADSI searches enumerate domain-joined Windows Server computer objects, resolve addresses, and probe each for administrative reachability (CIM-based checks); a second ADSI query pulls all user objects and their description attributes (which can hold privileged-account context). Randomized sleep jitter indicates deliberate low-noise enumeration.
11. Follow-on payloads (T1218.011). Additional payloads executed via rundll32.exe loading actor-supplied DLLs — short innocuous filenames, invoked via an exported function open with a per-execution token argument, consistent with modular loaders gated behind a runtime-supplied key.
12. Lateral movement (T1021.006). Operator tasking initiates WinRM connections on TCP 5985 to a large set of domain-joined systems — dozens of hosts, multiple regions and roles: file servers, database/application servers, and critically domain controllers and certificate authorities. WinRM from a non-administrative application context strongly suggests credential-backed lateral movement. Microsoft assesses this stage as a hallmark of intrusions preceding large-scale data theft or ransomware deployment.

Malware family and attribution — confidence caveat. Microsoft's detections include Trojan:JS/EtherRatz.A!MTB / .B!MTB, and the Ethereum-contract C2-resolution logic matches Unit 42's published description of EtherRAT (a Node.js RAT, cross-platform Windows/Linux/macOS, fetching active C2 from an Ethereum smart contract with a conventional fallback domain) — corroborated by The Register and BleepingComputer coverage of the Unit 42 campaign. However, the Microsoft report does not name a threat actor, and no MITRE ATT&CK group profile exists in the verified reference data for this item — attribution is unconfirmed; treat the actor as unnamed. Note also that the Unit 42 campaign described a phishing-email precursor and HopToDesk/AnyDesk RMM handoff, whereas the Microsoft chain starts with Teams contact directly; the two reports overlap on the EtherRAT/Node.js implant and Ethereum-contract C2 but are not identical campaigns. The Chaos-ransomware Teams-vishing reporting (BleepingComputer) is a related but distinct intrusion set.

Single-sourced detail. The CtrlVirtualCursorWin_* forensic artefact (files Teams creates during remote-control sessions) comes from Unit 42 via The Register only — single-sourced; verify in your own environment before relying on it for enforcement.

4. Mitigation & containment

P1 — within 24 hours

• Hunt, don't assume. Run the Microsoft advanced-hunting patterns (§6 equivalents) across the last 30 days: (a) external-tenant Teams chats (CloudAppEvents, ActionType == "ChatCreated", IsExternalUser == true); (b) PowerShell-written .msi files landing in \Downloads\, \AppData\, \Temp\; (c) node.exe executing from \AppData\Local\ without a .js argument, or spawned by wscript.exe; (d) node.exe child processes powershell.exe/cmd.exe with CopyFromScreen, ToBase64String, System.Drawing.Bitmap, WriteAllText in the command line (screenshot capture); (e) PowerShell-initiated connections to RemoteUrl ending :5985/wsman.
• Block the C2 and staging domains in §5 at proxy/DNS: the five *.blob.core.windows.net MSI-hosting endpoints and the three C2 domains. Note these are Azure infrastructure — if you allow-list Azure Blob or cloudapp broadly, add explicit denies for these hostnames.
• Contain any confirmed host: isolate endpoint, kill node.exe running from user-writable paths, remove the EdgeUpdate Run value (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) and any EdgeUpdate shortcut in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup, delete the randomly named LocalAppData directory containing the portable Node.js runtime and .tmp/.ini/.dat/.bin/.cfg loader files. Caution: EdgeUpdate is also a legitimate Google Chrome updater name — verify the value points to a LocalAppData Node.js path before deleting, and do not mass-delete legitimate EdgeUpdate entries.
• On any confirmed compromise: treat credentials on the host as compromised. Rotate the victim's credentials, then rotate credentials for any accounts observed in WinRM connections to DCs/CAs. The WinRM pivot to identity infrastructure means krbtgt/CA-level response planning may be needed if compromise is confirmed at that tier.
• Alert your helpdesk and users now: no legitimate internal IT function will ask a user to grant remote control to an external-tenant Teams contact or read out a Quick Assist code to an unsolicited caller. Instruct users to end and report any such contact.

P2 — within 72 hours

• Restrict Teams external collaboration: in the Teams admin centre, limit external chat/calling to trusted tenants or block external TenantsContext chat for users who don't need it; ensure external-tenant labelling and Accept/Block prompts are enforced rather than bypassed by policy.
• Constrain consumer/unsanctioned RMM: block Quick Assist and common remote-assistance binaries for standard users via AppLocker/WDAC where the business allows; if Quick Assist is required, restrict it to a named support group.
• WinRM hardening: if WinRM (5985/5986) is not required for workstation-to-server ad-hoc management, disable the WinRM service on workstations and restrict 5985 ingress at host firewalls to approved admin jump hosts. Require HTTPS/5986 with certificate auth where WinRM must remain.
• EDR/Sigma coverage: deploy the §6 rules; ensure AV detections for the listed Microsoft signatures are not in audit-only mode.
• User-writable execution controls: block or alert on execution of any executable (including signed node.exe) from %LOCALAPPDATA% via WDAC/AppLocker; alert on WScript launching node.exe.

P3 — within 7 days

• Process fix: publish a verified-callback procedure — any remote-support request is validated by the user calling back the service desk on a published internal number. This is the control that actually breaks this chain.
• Purple-team the chain: tabletop or live-test the full path (external Teams contact → RMM session → silent MSI → LocalAppData Node.js → WinRM pivot) against your detections; DORA Art. 24 resilience testing should include this scenario.
• Review cloud-storage egress: the MSI delivery and C2 both ride trusted Azure domains. Confirm proxy policy inspects and can block specific Azure Blob/cloudapp hostnames rather than blanket-trusting them.

5. Indicators of compromise

All indicators below are from the Microsoft Threat Intelligence report (single primary source for this specific campaign; the EtherRAT family linkage is corroborated by Unit 42 via The Register/BleepingComputer). Network indicators defanged.

sha256  4cfdcae6dd1d6d98b870c8f0654d504f2bf10479a117dc297de789c249dc389d
sha256  a4d145a6347e47d40b3ca48af5c6dba01bf019d0110e31a44bb70fc77d1d1676
sha256  cc6d0f3f47afeba018173604e34f527e8413d3a54ffb35caed529bff49055ec5
sha256  0d2fc28af246f62f27e49207d1f64e236ad9ea029412b27877d1ae6c098e86e3
sha256  69e10e0cb7bb2137ebea12971adb02c662cf5543a4f8c9530812bcbf7b183a23
sha256  a135fe4df18c711097e69b4f27ea32a74a955160bf2fb12da841f21866d95d87
domain  update1n5[.]blob[.]core[.]windows[.]net
domain  update1n6[.]blob[.]core[.]windows[.]net
domain  update1n7[.]blob[.]core[.]windows[.]net
domain  update1n9[.]blob[.]core[.]windows[.]net
domain  updatetmp[.]blob[.]core[.]windows[.]net
domain  synctimes[.]australiaeast[.]cloudapp[.]azure[.]com
domain  webwether[.]eastus[.]cloudapp[.]azure[].com
domain  dssdfvsdfvsdfvsdgbfbdvdzv[.]org

Behavioural indicators (hunt for these patterns; environment-specific values were generalized by Microsoft):

6. Detection

/*
    YARA rule targeting the Node.js implant loader staged by the
    Teams helpdesk-impersonation MSI campaign. Strings are drawn from
    observed artefacts: update-themed MSI names, the EdgeUpdate
    persistence name, nonstandard loader extensions, and the
    rundll32 open-export token-gated invocation.
*/
rule NodeJS_Implant_Loader_Teams_Helpdesk_Impersonation
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-03"
        reference = "https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/"
        description = "Detects loader/implant staging artefacts from Teams helpdesk-impersonation campaign delivering Node.js implant (EdgeUpdate persistence, update-themed MSI names, nonstandard loader extensions, rundll32 open-export invocation)"
        tlp = "AMBER"
    strings:
        $msi_name1 = "devfix" ascii nocase
        $msi_name2 = "Hotfix" ascii nocase
        $persist_name = "EdgeUpdate" ascii
        $ext_tmp = ".tmp" ascii
        $ext_ini = ".ini" ascii
        $ext_dat = ".dat" ascii
        $ext_bin = ".bin" ascii
        $ext_cfg = ".cfg" ascii
        $rundll_open = "open" ascii
        $appdata = "AppData\\Local" ascii
        $node = "node.exe" ascii nocase
    condition:
        uint16(0) == 0x0000 or true
        and $appdata and $node
        and 1 of ($msi_name1, $msi_name2, $persist_name)
        and 2 of ($ext_tmp, $ext_ini, $ext_dat, $ext_bin, $ext_cfg)
        and filesize < 5MB
}

Note: the YARA rule above is a staging-artefact heuristic built from campaign-specific strings; the implant itself is encrypted at rest and decrypted in memory or to a temporary .js file, so static file scanning of the encrypted payload will not match content strings. Prioritise the behavioural Sigma rules below and hash-based blocking of the six §5 SHA-256 values.

title: Node.js Implant Execution from LocalAppData - Teams Helpdesk Impersonation Campaign
id: 8f3c2a41-6d97-4b8e-9f2a-7c5d1e3b9024
status: experimental
description: >
  Detects the portable Node.js runtime executing a staged loader from a
  user-writable LocalAppData path, with no .js file in the command line
  (stdin-fed implant) or launched via WScript, as observed in the Teams
  IT-helpdesk impersonation campaign (Microsoft Threat Intelligence, 2026-09-02).
references:

  - https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/
author: Adverse Trace
date: 2026-09-03
tags:

  - attack.execution
  - attack.t1059.007
  - attack.defense_evasion
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection_node:
    Image|endswith: '\node.exe'
    CommandLine|contains: '\AppData\Local\'
    filter_js:
      CommandLine|contains: '.js'
    condition: not filter_js
  selection_wscript_parent:
    ParentImage|endswith: '\wscript.exe'
    Image|endswith: '\node.exe'
    ParentCommandLine|contains|all:

      - '\AppData\Local\'
      - 'node.exe'
      - '.js'
  condition: selection_node or selection_wscript_parent
falsepositives:

  - Legitimate Node.js applications installed under LocalAppData (e.g. user-scoped
    npm tooling) may generate node.exe executions from AppData; tune by excluding
    known-good parent processes and signed, version-pinned runtimes.
level: high

title: EdgeUpdate-Named Persistence Launching Node.js from LocalAppData - Teams Helpdesk Implant
id: c4e9d1f7-2a83-4b6c-8e5d-9f0a1b2c3d45
status: experimental
description: >
  Detects persistence named "EdgeUpdate" (HKCU Run key or Startup folder
  shortcut) that launches a Node.js loader from the user's LocalAppData,
  as created by the malicious MSI in the Teams helpdesk-impersonation
  campaign. Legitimate Google EdgeUpdate entries point to Google\Chrome
  paths, not LocalAppData Node.js runtimes.
references:

  - https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/
author: Adverse Trace
date: 2026-09-03
tags:

  - attack.persistence
  - attack.t1547.001
  - attack.t1036
logsource:
  category: registry_event
  product: windows
detection:
  selection_run_key:
    TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
    TargetObject|contains: 'EdgeUpdate'
    Details|contains: '\AppData\Local\'
    Details|contains: 'node'
  condition: selection_run_key
falsepositives:

  - None expected for a Run value named EdgeUpdate pointing at a LocalAppData
    Node.js path; legitimate Google updater entries reference
    \Google\Chrome\Application\ paths.
level: critical

title: Node.js Implant Screenshot Capture via PowerShell - Teams Helpdesk Impersonation Campaign
id: a7b3e5f1-8c29-4d0e-b6f4-2d8a9c1e3f56
status: experimental
description: >
  Detects node.exe spawning powershell.exe or cmd.exe whose command line
  contains .NET screen-capture and Base64-encoding class references, as
  observed when the implant's JavaScript tasking captures and stages
  screenshots for exfiltration.
references:

  - https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/
author: Adverse Trace
date: 2026-09-03
tags:

  - attack.collection
  - attack.t1113
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\node.exe'
  selection_child:
    Image|endswith:

      - '\powershell.exe'
      - '\cmd.exe'
  selection_cli:
    CommandLine|contains:

      - 'CopyFromScreen'
      - 'ToBase64String'
      - 'System.Drawing.Bitmap'
      - 'System.Drawing'
      - 'WriteAllText'
  condition: all of selection_*
falsepositives:

  - Unlikely in standard enterprise estates; legitimate screenshot tooling
    rarely runs as a node.exe child with these .NET class references.
level: critical

title: WinRM Lateral Movement Initiated by PowerShell with Bypass Flags - Teams Helpdesk Campaign
id: e2f8a4b6-1d37-4c9e-8a5b-6f0d2e4a8c91
status: experimental
description: >
  Detects PowerShell processes launched with -NoLogo -NoProfile
  -ExecutionPolicy Bypass initiating connections to WinRM endpoints
  (:5985/wsman), matching the lateral-movement pattern toward domain
  controllers and certificate authorities in the Teams helpdesk
  impersonation campaign.
references:

  - https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/
author: Adverse Trace
date: 2026-09-03
tags:

  - attack.lateral_movement
  - attack.t1021.006
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort: 5985
    Image|endswith: '\powershell.exe'
    CommandLine|endswith: '-NoLogo -NoProfile -ExecutionPolicy Bypass'
  condition: selection
falsepositives:

  - Legitimate administrative WinRM scripts using these common flags;
    tune by baseline and by excluding approved admin jump hosts.
level: high

title: Silent MSI Install Written by PowerShell to User-Writable Path - Teams Helpdesk Campaign
id: b9d4f2e8-7a61-4b3c-9e0d-5c7a1f3b9e24
status: experimental
description: >
  Detects PowerShell writing an .msi file into Downloads, AppData, or
  Temp with explorer.exe as the parent of the PowerShell process,
  matching the MSI delivery stage of the Teams helpdesk impersonation
  campaign (user-initiated remote session, then silent msiexec /qn).
references:

  - https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/
author: Adverse Trace
date: 2026-09-03
tags:

  - attack.execution
  - attack.t1059.001
  - attack.t1218.007
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    TargetFilename|endswith: '.msi'
  filter_paths:
    TargetFilename|contains:

      - '\Downloads\'
      - '\AppData\'
      - '\Temp\'
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  condition: selection and 1 of filter_paths and selection_parent
falsepositives:

  - Rare; legitimate software installs via user-launched PowerShell to
    Downloads are uncommon in managed estates.
level: high

7. Sources

• Microsoft Threat Intelligence — Impersonating IT support: how threat actors turn a remote session into enterprise-wide access — https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/ — 2026-09-02
• The Register Security — Fake IT bods on Microsoft Teams coax workers into installing malware (Unit 42/EtherRAT reporting) — https://www.theregister.com/cyber-crime/2026/07/07/fake-it-bods-on-microsoft-teams-coax-workers-into-installing-malware/5267610 — 2026-07-07
• BleepingComputer — Fake IT support calls on Microsoft Teams push EtherRAT malware — https://www.bleepingcomputer.com/news/security/fake-it-support-calls-on-microsoft-teams-push-etherrat-malware/ — (undated in provided material)
• Cybersecurity Dive — Hackers abuse Microsoft Teams in ransomware campaign through fake IT support — https://www.cybersecuritydive.com/news/hackers-microsoft-teams-ransomware-it-support/826591/ — (undated in provided material)
• BleepingComputer — Microsoft Teams vishing attacks lead to Chaos ransomware attacks — https://www.bleepingcomputer.com/news/security/microsoft-teams-vishing-attacks-lead-to-chaos-ransomware-attacks/ — (undated in provided material)

8. Adverse Trace position

This is a high-impact human-operated campaign despite involving no CVE: the entire chain rides legitimate, signed, trusted tooling (Teams, RMM software, msiexec, official Node.js distribution, WinRM), which means vulnerability-driven and unsigned-binary defences contribute almost nothing. The bottom line for EMEA financial services is that a single persuaded user converts into credential-backed interactive access that, in the observed campaign, pivoted over WinRM toward domain controllers and certificate authorities — pre-ransomware staging territory. Severity: high for any client with external Teams collaboration enabled and permissive WinRM; the mitigations that matter are process controls (verified helpdesk callback, external-tenant chat restriction, RMM restriction) plus behavioural detection of LocalAppData Node.js execution and the EdgeUpdate-named persistence. Confidence caveats: the campaign-specific IOC set and attack chain are single-sourced to Microsoft Threat Intelligence (high-quality primary telemetry, but uncorroborated by a second vendor for this exact chain); the EtherRAT family linkage is corroborated by Unit 42 reporting but the two campaigns are not identical; the CtrlVirtualCursorWin_* artefact is single-sourced and should be verified before enforcement; and no threat-actor attribution is confirmed — no MITRE group profile exists in our verified reference data for this activity, so treat the actor as unnamed. Adverse Trace will monitor for a named-actor attribution, additional IOC corroboration, and any confirmed ransomware follow-on in this chain, and will reissue if the dormant Ethereum-contract C2-resolution logic is observed enabled in the wild.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.