Arctic Wolf has recorded more than 400 incidents in which attackers contact employees through Microsoft Teams external chats, posing as internal technical support with names such as IT Support (Internal). They persuade victims to grant remote access with tools such as Quick Assist or AnyDesk, which in some cases leads to a ransomware attack. Around 30 to 40% of the messages come from accounts in free or trial Microsoft tenants with an onmicrosoft.com address.

What it means: The attack exploits the trust employees place in internal collaboration tools. A Teams message looks more credible than an email, especially when the sender name resembles the company’s IT department, and in similar campaigns it is often preceded by flooding the victim with spam so that the offer of help seems reasonable. Once the employee grants remote access, the attacker controls the computer without needing any vulnerability. Many Greek businesses use Microsoft 365 with default settings that allow chats with external users from any organisation. Administrators can restrict external communication to known partners or block onmicrosoft.com tenants, and Quick Assist can be disabled where it is not used. Staff awareness matters just as much: real IT support never unexpectedly asks for access through an external chat, and any such request should be confirmed by phone on a known number. A short internal guideline with these rules can prevent a costly ransomware attack.

Read the original on Arctic Wolf

Related service: Custom software

Related stories