How hacker gangs abuse Microsoft Teams for social engineering attacks to target companies

Multiple ransomware gangs are using a combination of social engineering and Microsoft Teams to breach organizations. The attack has a fairly standardized process designed to overwhelm the target: 

1. Email Bombing - the attack begins with threat actors flooding the victim's inbox with a spam email messages in a short period of time. This is an unexpected and unpleasant situation for any user, making them concerned about why they are being suddenly targeted. It puts the victim in a state of mind of urgency and legitimizes unexpected "IT support" contacts.
2. Microsoft Teams Contact - the threat actors create a Microsoft cloud tenant that mimics the naming convention of the target organization, usually with a suffix that sounds like it's legitimate, like "*.onmicrosoft.com". The attackers set their profiles to a "DisplayName" indicating some form of help-desk, often using the string "Help Desk" surrounded by whitespace characters to center the name. Then they send a Microsoft Teams chat request to the victim.  
3. Social Engineering - once the victim accepts the Teams chat, the attackers guide them through executing PowerShell commands that appear legitimate but actually download and run malicious scripts. Hackers Mimic IT Teams to Exploit Microsoft Teams Request to Gain System Remote Access.
4. Malicious Script Execution - the initial command executed bypasses Windows security policies and downloads a PowerShell script called "runner.ps1" from attacker-controlled domains. That script downloads other files which steal data from the victim machine, including cryptocurrency wallet, password manager, VPN session, system and cookie information and exploits unpatched vulnerablities to take control of the machine for further attacks.

The success of this attack relies on Microsoft Teams' default configuration, which is very permissive. By default, Microsoft 365 permits calls and chats from external domains. This means that users can add apps when they host meetings or chats with people outside your organization.

The actor either uses Microsoft 365 tenants they have compromised in previous attacks or even creates their own tenant. The attack barrier to entry is relatively low - they just need to create a legitimate-looking tenant with a convincing name.

An external Teams message may not set off red flags with employees, since employees are usually trusting their corporate chat systems to be "internal". So any contact via that channel is assumed to be trusted. 

Multiple attacks using these techniques have been reported by researchers from ReliaQuest, Microsoft Threat Intelligence and Sophos.

How to stay safe?

1. Admins Should Restrict External Teams Access: In the Teams admin center, you block all external domains in your External access settings
2. Educate Users: Educate Microsoft Teams users to verify 'External' tagging on communication attempts from external entities, be careful about what they share, and never share their account information, authorize sign-in requests or run programs sent over chat.
3. Establish Callback: If an unknown person contacts the employee via Teams and claims some authority function (helpdes, security, management), the employees should contact back via the official channel and account published in the intranet. Not to continue talking to the unknown person reaching to them.
4. Patch Devices: Organizations should diligently apply Microsoft patches, because they are the most commonly exploited to take over the computer.