Ransomware groups abuse Microsoft Teams external access for rapid remote compromise

1. Executive summary

Arctic Wolf has documented more than 400 incidents in which actors used Microsoft Teams external access (federation) to pose as internal IT help desk staff, after first flooding the target's inbox with newsletter and subscription spam to create a plausible problem for the fake help desk to fix. The technique exploits no vulnerability: external access is on by default in Teams, and any user in another Microsoft 365 tenant can find, chat with and call an organisation's employees where both tenants permit federation. Arctic Wolf attributes the pattern to a playbook Microsoft first described in mid-2024 in Black Basta activity and which has since appeared in Cactus, 3AM and Chaos operations; none of those four actors has a MITRE ATT&CK profile, so the attribution is unconfirmed. No CVE is associated with this item and there is no CISA KEV entry to track. The risk to EMEA financial services is remote access gained in under 15 minutes from first contact, with observed outcomes including Active Directory enumeration, data theft and ransomware.

2. Regulatory framing

3. Technical analysis & attack chain

The operation is social engineering over a legitimate collaboration feature. Arctic Wolf states plainly that the activity does not exploit any known Teams vulnerability; it abuses external access, which ships enabled by default. Any Teams user in another Microsoft 365 tenant can find, chat with and call an organisation's employees, provided both tenants allow external access.

Confirmed steps, as described by Arctic Wolf:

1. The actor creates or obtains a Microsoft 365 tenant. Between 30 and 40 percent of cases used free onmicrosoft.com tenants, which require no verification and can be set up in minutes. Arctic Wolf also records a shift toward paid domains: of the paid domains it identified in these scams over recent months, roughly 50 percent used the .top TLD, around 40 percent a standard .com, and just over five percent multi-level domains such as .com.pl, .com.vn and .com.br.
2. The actor gives the tenant and display names an IT appearance, for example "helpdeskteam365" and "itcoreportal". Display names add "(Internal)" so the sender appears to work at the company even though Teams labels them external, and use forms such as "IT Service Desk (Matthew)" to read as a coworker. Some messages were written in the target's local language. More than 100 names included emoji such as shields and wrenches; Arctic Wolf believes this may indicate AI tools are being used to create the identities. In the latest cases the actor put the victim company's name or domain into its own display name.
3. The victim's inbox is flooded with hundreds of newsletter and subscription confirmations. In many cases the fake help desk message on Teams arrived minutes later.
4. The actor contacts the target over Teams external chat and offers to fix the problem it created. Arctic Wolf notes employees are trained to treat email with suspicion, and a message inside the company's own Teams environment gets around that caution.
5. On response, the fake technician moves to a Teams voice call and asks the target to install remote access software. Quick Assist is the most common choice because it ships with Windows and the victim only has to read back a six-digit code. AnyDesk and ScreenConnect also appear, often installed as a second path that remains after the first is removed.
6. The actor avoids posting links in Teams, where they would be scanned, and downloads malicious files itself during the remote session.
7. In one case the fake help desk worker had the employee run a PowerShell command that triggered a chain of hidden scripts. The final script installed a Python implant that collected the names and descriptions of every user and computer account in the organisation's Active Directory and sent the list to actor-controlled servers.

Timing is the operational point. Arctic Wolf reports actors commonly target multiple users within short windows of about five minutes, most likely through automation, and that once someone engages it can take less than 15 minutes for malicious code to start running. In some cases credential theft alerts fired at the same time as the alert for the first Teams chat, meaning the host was already compromised by the time anyone looked at it. Some intrusions ended with data theft and ransomware.

Attribution and confidence. Arctic Wolf links the pattern to a technique Microsoft first described in mid-2024 in attacks tied to Black Basta, and says it has since appeared in Cactus, 3AM and Chaos operations. None of Black Basta, Cactus, 3AM or Chaos has a MITRE ATT&CK profile, so the actor attribution is unconfirmed and should not be used to drive blocking decisions. The 400-plus incident count, the tenant and display-name statistics, the TLD breakdown and the PowerShell-to-Python-implant case are single-sourced to Arctic Wolf; treat them as one vendor's telemetry until corroborated. The Sophos reporting on Chaos moving from onmicrosoft.com tenants to IT-themed .top domains is referenced by Arctic Wolf as prior reporting, not independently verified here.

4. Mitigation & containment

P1 within 24h

• Restrict Teams external access to named partner domains. Arctic Wolf's position is that most organisations have no need to accept chats from any outside tenant; allow external chats only with specific partner domains. In the Teams admin center this is External access, where you add allowed domains and set the default to blocked for everything else.
• Block unmanaged Teams accounts and trial tenants. These are the free onmicrosoft.com tenants that make up 30 to 40 percent of Arctic Wolf's cases.
• Restrict Quick Assist to authorised IT staff. On managed Windows endpoints, control the Quick Assist app (Microsoft Store app, package family name MicrosoftCorporationII.QuickAssist) through AppLocker or Intune app control so it cannot be launched by standard users. Quick Assist is the most common tool in these intrusions because it needs only a six-digit code read back to the caller.
• Inventory AnyDesk and ScreenConnect across the estate and remove them where IT has not sanctioned them. Arctic Wolf observed both installed as a second remote path that survives removal of the first.
• Brief the service desk and all staff that IT will never open an unsolicited Teams chat or call to fix an inbox problem, and that no one should read a Quick Assist code to an inbound caller. The vector defeats email-suspicion training specifically, so the message has to name Teams.

P2 within 72h

• Hunt Teams audit and message logs for external federated chats and calls to staff from non-allow-listed tenants, and for display names containing "(Internal)", IT-themed strings such as "helpdesk" or "itcoreportal", or the company's own name or domain. Prioritise any that coincide with a spike of newsletter or subscription mail to the same user.
• Hunt endpoint telemetry for Quick Assist sessions (quickassist.exe) initiated by users who are not IT staff, and for AnyDesk or ScreenConnect installs outside the sanctioned software list, in the same window as an external Teams chat.
• Review PowerShell script block logging and process creation for chains of hidden scripts spawned from a Quick Assist session, and for Python interpreter execution on endpoints that have no business running Python. The observed implant enumerated Active Directory user and computer names and descriptions and sent them to actor infrastructure.
• Alert on credential theft detections that coincide with a first-contact external Teams chat. Arctic Wolf's data shows the host can already be compromised at that point, so the Teams alert is a late signal, not an early one.

P3 within 7 days

• Add the impersonation pattern to phishing and social-engineering simulation, delivered over Teams rather than email, so staff practise the refusal.
• Review joiner, mover and leaver handling for the service desk so that an inbound "IT support" identity cannot be mistaken for a colleague during an active spam event.
• Where the client operates its own multi-tenant estate, audit which tenants are permitted to federate and record the allow-list as a controlled configuration item.

5. Indicators of compromise

No atomic indicators (hashes, domains, IPs, file paths) are present in the source material. Arctic Wolf's reporting describes behaviours and naming patterns rather than machine-pivotable artefacts. The tenant names below are examples cited by Arctic Wolf and are not confirmed malicious infrastructure; do not block on them without verification.

Behavioural indicators

6. Detection

No file hashes, mutexes, registry keys or ransom-note strings are present in the source material, so a YARA rule would have nothing genuine to match. The usable material is behavioural and belongs in Sigma.

title: Quick Assist Session Started by Non-IT User
id: 8f2c1a44-6b7e-4d2a-9c31-teamshelpdesk01
status: experimental
description: Detects quickassist.exe launched by a user outside the IT group, consistent with fake help desk remote access over Microsoft Teams
author: Adverse Trace
date: 2026/10/27
references:

  - https://www.helpnetsecurity.com/2026/10/27/microsoft-teams-social-engineering-fake-it-help-desk/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\quickassist.exe'
  filter_it:
    User|contains:

      - 'IT-'
      - 'Helpdesk'
  condition: selection and not filter_it
falsepositives:

  - Legitimate support sessions initiated by IT staff whose accounts do not match the filter
level: medium

title: Unauthorized Remote Access Tool Installed After External Teams Contact
id: 3d9b7e12-4a5c-4f88-b2d0-teamshelpdesk02
status: experimental
description: Detects AnyDesk or ScreenConnect installation, consistent with a second remote access path installed during a fake IT help desk session
author: Adverse Trace
date: 2026/10/27
references:

  - https://www.helpnetsecurity.com/2026/10/27/microsoft-teams-social-engineering-fake-it-help-desk/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:

      - '\AnyDesk.exe'
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
  condition: selection
falsepositives:

  - Sanctioned remote support deployments; scope to hosts outside the approved software list
level: medium

title: PowerShell Script Chain Spawning Python Interpreter
id: 6c1e2f90-8d3a-4b57-a1e4-teamshelpdesk03
status: experimental
description: Detects a PowerShell parent process spawning python.exe, consistent with the hidden script chain and Python AD-enumeration implant described by Arctic Wolf
author: Adverse Trace
date: 2026/10/27
references:

  - https://www.helpnetsecurity.com/2026/10/27/microsoft-teams-social-engineering-fake-it-help-desk/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\powershell.exe'
    Image|endswith:

      - '\python.exe'
      - '\pythonw.exe'
  condition: selection
falsepositives:

  - Developer and data-science endpoints running Python from PowerShell automation
level: medium

Teams external-chat detection should be built in the Microsoft 365 audit log rather than Sigma: alert on external federated chat or call events where the contacting tenant is not on the allow-list, and enrich with the display-name patterns in section 5.

7. Sources

• Help Net Security, "Hackers bury inboxes in spam then show up on Microsoft Teams posing as IT support", https://www.helpnetsecurity.com/2026/10/27/microsoft-teams-social-engineering-fake-it-help-desk/, 2026-10-27. Reports Arctic Wolf's findings; the primary source for this advisory.
• The Hacker News, "Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware", https://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html, 2026-10. Corroborates the recurring pattern of throwaway tenants and IT-themed impersonation.
• Arctic Wolf, the underlying research reported by both outlets above. The original Arctic Wolf publication URL is not included in the material supplied to Adverse Trace; clients wanting the primary telemetry should obtain it directly from Arctic Wolf.
• Sophos, prior reporting on the Chaos ransomware campaign's move to IT-themed .top domains, referenced by Arctic Wolf. Not independently reviewed for this advisory.

8. Adverse Trace position

No CVE is associated with this item and there is no CISA KEV entry, so severity here is driven by impact and speed rather than a patchable flaw: interactive remote access in under 15 minutes, Active Directory enumeration, and in some cases data theft and ransomware. The actor attribution to Black Basta, Cactus, 3AM and Chaos is unconfirmed, since none has a MITRE ATT&CK profile, and the incident statistics are single-sourced to Arctic Wolf; we treat the technique as established and the attribution as unverified. For EMEA financial services clients the exposure is concentrated in tenant federation configuration and endpoint remote-access permissions, both of which are under the client's control and both of which DORA Art. 17 and NIS2 Art. 21(2)(d) make auditable. We assess that clients who have not restricted Teams external access to named partner domains and have not limited Quick Assist to IT staff should treat this as an open initial-access path. Adverse Trace will monitor for corroborating vendor reporting on the tenant and TLD patterns before issuing any blocking guidance, and will update this advisory if atomic indicators or a confirmed actor profile become available.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.