Impersonating IT support: how threat actors turn a remote session into enterprise-wide access | Microsoft Security Blog

What Happened

Attackers are impersonating IT support staff through Microsoft Teams to trick employees into giving them remote access to their computers. Once connected, the attackers install malicious software that lets them control the device, take screenshots, explore the company network, and move toward critical systems like domain controllers. This matters because it can lead to widespread data theft or ransomware. Employees should be trained to verify any unsolicited IT support requests through known internal channels before granting remote access, and organizations should restrict external Teams access and monitor remote support tools.

Key Takeaways

• Threat actors abuse Microsoft Teams external collaboration to impersonate IT support and socially engineer users into granting remote access via tools like Quick Assist.
• Attackers use PowerShell to download and silently install a malicious MSI package, which stages a portable Node.js runtime and an obfuscated JavaScript implant for persistent C2.
• The implant performs extensive host and Active Directory reconnaissance, captures periodic screenshots, and uses WinRM for lateral movement toward high-value assets like domain controllers.
• The campaign relies heavily on legitimate tooling (Teams, RMM tools, Windows Installer, Node.js, WinRM) to blend into expected enterprise operations.
• Dormant blockchain-based C2 logic was found in the implant, capable of querying an Ethereum smart contract for an updated C2 URL.

Affected Systems

• Microsoft Teams
• Windows operating systems
• Active Directory environments
• Domain Controllers
• Certificate Authorities

Vulnerabilities (CVEs)

None identified.

Attack Chain

1. Initial Access: Threat actor impersonates IT support via Microsoft Teams external chat, coaxing user into granting remote control via Quick Assist or Teams screen-share.
2. Execution: Attacker uses PowerShell to download a malicious MSI from cloud storage and installs it silently with msiexec /qn.
3. Staging: MSI retrieves a portable Node.js runtime from the official Node.js distribution and extracts it to a random directory under LocalAppData, along with an encrypted implant file.
4. Persistence: MSI creates an HKCU Run value or Startup folder shortcut named EdgeUpdate to launch the Node.js loader at user logon.
5. C2: The implant uses randomized HTTPS long-polling to receive JavaScript tasks from its C2 server, enabling host reconnaissance, screen capture, and follow-on payload execution.
6. Discovery: Operator enumerates domain accounts, servers, and users through native tools and ADSI queries with jitter to avoid detection.
7. Lateral Movement: Operator initiates WinRM connections over TCP port 5985 to domain-joined systems, including domain controllers and certificate authorities.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: Yes
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No
• Platforms: Microsoft Defender XDR Advanced Hunting

The article provides multiple KQL queries for Microsoft Defender XDR advanced hunting covering external Teams activity, PowerShell writing MSI files, Node.js executing staged payloads, screen capture via PowerShell, and WinRM lateral movement.

Detection Engineering Assessment

Required Log Sources

• Microsoft Teams chat logs (CloudAppEvents)
• DeviceProcessEvents
• DeviceFileEvents
• DeviceNetworkEvents
• Windows Event Logs (WinRM, PowerShell Script Block Logging)
• Active Directory enumeration logs

Hunting Hypotheses

Control Gaps

• Signature-based AV may miss the attack due to use of legitimate signed binaries like Node.js and msiexec
• External collaboration policies in Teams may allow initial contact if users override warnings
• Network-based blocking may not catch C2 traffic to legitimate Azure cloud services
• Per-user persistence in HKCU Run key or Startup folder may bypass admin-focused monitoring

Key Behavioral Indicators

• node.exe executing from LocalAppData with nonstandard file extensions
• External Teams chat followed by Quick Assist or remote support tool execution
• msiexec.exe /qn installing packages from Downloads or AppData directories
• rundll32.exe loading DLLs with exported function 'open' and a token argument
• PowerShell using CopyFromScreen and ToBase64String for screen capture
• WinRM connections on port 5985 initiated from non-administrative processes
• ADSI queries filtering for Server operating systems with random sleep jitter
• HKCU Run key or Startup folder shortcut named EdgeUpdate launching Node.js

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Consider restricting Microsoft Teams external access to trusted domains only.
• Evaluate whether WinRM (TCP 5985) can be limited to authorized management workstations, and consider alerting on WinRM initiated from user-context processes.
• Consider enabling network protection and web protection in Microsoft Defender for Endpoint to block connections to threat actor infrastructure.
• Consider deploying ASR rules that block executable content from scripting interpreters and execution of downloaded content.

User Protection

• Consider establishing internal helpdesk authentication phrases so employees can verify IT support requests.
• Consider training employees to recognize external-tenant indicators in Microsoft Teams and to never grant remote access to unsolicited contacts.
• Consider limiting or monitoring remote monitoring and management (RMM) and interactive remote-support software in the environment.
• Consider enforcing phishing-resistant MFA and compliant device requirements through Conditional Access policies.

Security Awareness

• Consider rolling into existing awareness programs guidance on verifying unsolicited IT support contact through known internal channels.
• Consider training employees to recognize social engineering tactics in collaboration platforms, not just email.
• Consider educating staff on the risks of granting remote control during unsolicited support calls or chats.

MITRE ATT&CK Mapping

Additional IOCs

• Domains:
  • updatetmp[.]blob[.]core[.]windows[.]net - Azure Blob Storage endpoint hosting the malicious MSI loader
  • synctimes[.]australiaeast[.]cloudapp[.]azure[.]com - Hardcoded fallback C2 and latest URL stored in the associated Ethereum contract
  • webwether[.]eastus[.]cloudapp[.]azure[.]com - Earlier C2 URL stored in the Ethereum contract
  • dssdfvsdfvsdfvsdgbfbdvdzv[.]org - Earlier C2 URL stored briefly in the Ethereum contract
• Registry Keys:
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run\EdgeUpdate - Per-user persistence via Run key launching Node.js loader from LocalAppData
• File Paths:
  • %LOCALAPPDATA%\<random>\node.exe - Portable Node.js runtime extracted to a randomly named directory under LocalAppData
  • %LOCALAPPDATA%\<random>\<payload>.tmp - Encrypted implant file with nonstandard extension executed by Node.js
• Command Lines:
  • Purpose: Download malicious MSI from cloud storage | Tools: powershell.exe | Stage: Execution | iwr -Uri <url> -OutFile <path>
  • Purpose: Silently install malicious MSI package | Tools: msiexec.exe | Stage: Execution | msiexec.exe /i <path> /qn
  • Purpose: Download and extract portable Node.js runtime | Tools: curl.exe, tar.exe | Stage: Execution | curl -sLo <path> <url>
  • Purpose: Launch Node.js with staged payload via WScript | Tools: wscript.exe, node.exe | Stage: Execution | shell.Run("<path>\node.exe <path>\<payload>.tmp"
  • Purpose: System discovery and fingerprinting | Tools: cmd.exe, powershell.exe, reg.exe | Stage: Discovery | cmd /c "net session"
  • Purpose: Automated screen capture and Base64 encoding | Tools: powershell.exe | Stage: Collection
  • Purpose: Active Directory server enumeration via ADSI with jitter | Tools: powershell.exe | Stage: Discovery | $q = [ADSISearcher]::new([ADSI]"LDAP://$d")
  • Purpose: Follow-on payload execution via rundll32 | Tools: rundll32.exe | Stage: Execution | rundll32.exe <dll>,open <token>
  • Purpose: WinRM lateral movement from non-admin process | Tools: powershell.exe | Stage: Lateral Movement | powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass
• Other:
  • Ethereum smart contract C2 resolver - Dormant logic in the implant capable of querying an Ethereum smart contract for an updated C2 URL