CTIPilot

Microsoft Teams

product · product:microsoft-teams single-source

Coverage timeline
4
first 2026-07-25 → last 2026-09-03
Peak priority
high
3 high · 1 notable
Sources cited
4
3 hosts
Sections touched
2
active-threats, research
Co-occurring entities
8
see Co-occurring entities below
ATT&CK techniques
38
pinned v19.2 · see below

Hunting pivots

Releases covered
Microsoft Teams ×4
ATT&CK techniques
T1018 ×2T1059.001 ×2T1071.001 ×2T1082 ×2T1090 ×2T1105 ×2T1113 ×2T1566.003 ×2T1566.004 ×2T1007T1016T1021.001T1021.006T1027T1036T1036.005T1053.005T1056.002T1057T1059.007T1078T1087.002T1204.002T1218.007
Tags
identity ×4phishing ×4organized-crime ×3cloud ×2ransomware ×2infostealer

ATT&CK techniques

38 techniques observed across 4 entries, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

Resource Development TA0042

T1584.006Compromise Infrastructure: Web Services×1

Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.

Evidence: 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · ATT&CK page ↗

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · ATT&CK page ↗

T1566Phishing×1

Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.

Evidence: 2026-07-25/microsoft-email-threat-landscape-q2-2026-teams-vishing-surge · ATT&CK page ↗

T1566.003Phishing: Spearphishing via Service×2

Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.

Evidence: 2026-09-03/teams-helpdesk-impersonation-nodejs-implant-winrm-dc-pivot · 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · ATT&CK page ↗

T1566.004Phishing: Spearphishing Voice×2

Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient.

Evidence: 2026-07-29/stac4749-teams-vishing-certificate-pinned-golang-chaos · 2026-07-25/microsoft-email-threat-landscape-q2-2026-teams-vishing-surge · ATT&CK page ↗

Execution TA0002

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · ATT&CK page ↗

T1059.001Command and Scripting Interpreter: PowerShell×2

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).

Evidence: 2026-09-03/teams-helpdesk-impersonation-nodejs-implant-winrm-dc-pivot · 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · ATT&CK page ↗

T1059.007Command and Scripting Interpreter: JavaScript×1

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.

Evidence: 2026-09-03/teams-helpdesk-impersonation-nodejs-implant-winrm-dc-pivot · ATT&CK page ↗

T1204.002User Execution: Malicious File×1

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.

Evidence: 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · ATT&CK page ↗

Persistence TA0003

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · ATT&CK page ↗

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · ATT&CK page ↗

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder×1

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

Evidence: 2026-07-29/stac4749-teams-vishing-certificate-pinned-golang-chaos · ATT&CK page ↗

T1547.009Boot or Logon Autostart Execution: Shortcut Modification×1

Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.

Evidence: 2026-07-29/stac4749-teams-vishing-certificate-pinned-golang-chaos · ATT&CK page ↗

Privilege Escalation TA0004

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · ATT&CK page ↗

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · ATT&CK page ↗

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder×1

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

Evidence: 2026-07-29/stac4749-teams-vishing-certificate-pinned-golang-chaos · ATT&CK page ↗

T1547.009Boot or Logon Autostart Execution: Shortcut Modification×1

Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.

Evidence: 2026-07-29/stac4749-teams-vishing-certificate-pinned-golang-chaos · ATT&CK page ↗

Stealth TA0005

T1027Obfuscated Files or Information×1

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-07-29/stac4749-teams-vishing-certificate-pinned-golang-chaos · ATT&CK page ↗

T1036Masquerading×1

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

Evidence: 2026-09-03/teams-helpdesk-impersonation-nodejs-implant-winrm-dc-pivot · ATT&CK page ↗

T1036.005Masquerading: Match Legitimate Resource Name or Location×1

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

Evidence: 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · ATT&CK page ↗

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · ATT&CK page ↗

T1218.007System Binary Proxy Execution: Msiexec×1

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi). The Msiexec.exe binary may also be digitally signed by Microsoft.

Evidence: 2026-09-03/teams-helpdesk-impersonation-nodejs-implant-winrm-dc-pivot · ATT&CK page ↗

T1218.011System Binary Proxy Execution: Rundll32×1

Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: <code>rundll32.exe {DLLname, DLLfunction}</code>).

Evidence: 2026-09-03/teams-helpdesk-impersonation-nodejs-implant-winrm-dc-pivot · ATT&CK page ↗

T1497.001Virtualization/Sandbox Evasion: System Checks×1

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

Evidence: 2026-09-03/teams-helpdesk-impersonation-nodejs-implant-winrm-dc-pivot · ATT&CK page ↗

T1620Reflective Code Loading×1

Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).

Evidence: 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · ATT&CK page ↗

T1684.001Social Engineering: Impersonation×1

Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims.

Evidence: 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · ATT&CK page ↗

Credential Access TA0006

T1056.002Input Capture: GUI Input Capture×1

Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control).

Evidence: 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · ATT&CK page ↗

T1528Steal Application Access Token×1

Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.

Evidence: 2026-07-25/microsoft-email-threat-landscape-q2-2026-teams-vishing-surge · ATT&CK page ↗

T1557Adversary-in-the-Middle×1

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.

Evidence: 2026-07-25/microsoft-email-threat-landscape-q2-2026-teams-vishing-surge · ATT&CK page ↗

Discovery TA0007

T1007System Service Discovery×1

Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as <code>sc query</code>, <code>tasklist /svc</code>, <code>systemctl --type=service</code>, and <code>net start</code>. Adversaries may also gather information about schedule tasks via commands such as `schtasks` on Windows or `crontab -l` on Linux and macOS.

Evidence: 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · ATT&CK page ↗

T1016System Network Configuration Discovery×1

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp, ipconfig/ifconfig, nbtstat, and route.

Evidence: 2026-09-03/teams-helpdesk-impersonation-nodejs-implant-winrm-dc-pivot · ATT&CK page ↗

T1018Remote System Discovery×2

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping, <code>net view</code> using Net, or, on ESXi servers, `esxcli network diag ping`.

Evidence: 2026-09-03/teams-helpdesk-impersonation-nodejs-implant-winrm-dc-pivot · 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · ATT&CK page ↗

T1057Process Discovery×1

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · ATT&CK page ↗

T1082System Information Discovery×2

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.

Evidence: 2026-09-03/teams-helpdesk-impersonation-nodejs-implant-winrm-dc-pivot · 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · ATT&CK page ↗

T1087.002Account Discovery: Domain Account×1

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.

Evidence: 2026-09-03/teams-helpdesk-impersonation-nodejs-implant-winrm-dc-pivot · ATT&CK page ↗

T1497.001Virtualization/Sandbox Evasion: System Checks×1

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

Evidence: 2026-09-03/teams-helpdesk-impersonation-nodejs-implant-winrm-dc-pivot · ATT&CK page ↗

T1518.001Software Discovery: Security Software Discovery×1

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-09-03/teams-helpdesk-impersonation-nodejs-implant-winrm-dc-pivot · ATT&CK page ↗

Lateral Movement TA0008

T1021.001Remote Services: Remote Desktop Protocol×1

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Evidence: 2026-07-29/stac4749-teams-vishing-certificate-pinned-golang-chaos · ATT&CK page ↗

T1021.006Remote Services: Windows Remote Management×1

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

Evidence: 2026-09-03/teams-helpdesk-impersonation-nodejs-implant-winrm-dc-pivot · ATT&CK page ↗

Collection TA0009

T1056.002Input Capture: GUI Input Capture×1

Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control).

Evidence: 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · ATT&CK page ↗

T1113Screen Capture×2

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.

Evidence: 2026-09-03/teams-helpdesk-impersonation-nodejs-implant-winrm-dc-pivot · 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · ATT&CK page ↗

T1557Adversary-in-the-Middle×1

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.

Evidence: 2026-07-25/microsoft-email-threat-landscape-q2-2026-teams-vishing-surge · ATT&CK page ↗

Command and Control TA0011

T1071.001Application Layer Protocol: Web Protocols×2

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-09-03/teams-helpdesk-impersonation-nodejs-implant-winrm-dc-pivot · 2026-07-29/stac4749-teams-vishing-certificate-pinned-golang-chaos · ATT&CK page ↗

T1090Proxy×2

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.

Evidence: 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader · 2026-07-29/stac4749-teams-vishing-certificate-pinned-golang-chaos · ATT&CK page ↗

T1105Ingress Tool Transfer×2

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

Evidence: 2026-09-03/teams-helpdesk-impersonation-nodejs-implant-winrm-dc-pivot · 2026-07-29/stac4749-teams-vishing-certificate-pinned-golang-chaos · ATT&CK page ↗

T1219Remote Access Tools×1

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Evidence: 2026-07-29/stac4749-teams-vishing-certificate-pinned-golang-chaos · ATT&CK page ↗

T1572Protocol Tunneling×1

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.

Evidence: 2026-07-29/stac4749-teams-vishing-certificate-pinned-golang-chaos · ATT&CK page ↗

Impact TA0040

T1486Data Encrypted for Impact×1

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.

Evidence: 2026-07-29/stac4749-teams-vishing-certificate-pinned-golang-chaos · ATT&CK page ↗

Story timeline

  1. 2026-09-03A Teams helpdesk-impersonation campaign installs a Node.js implant (Microsoft detection name: EtherRatz) via a silent MSI, then pivots over WinRM straight to domain controllers and certificate authorities
    active-threatsThe intrusion's most consequential step is a remote-management connection from a non-administrative process to systems that should never see one
  2. 2026-08-24SynkLoader: a Teams message from a lookalike tenant, an MSI called 'PowerShell Cleaner', and a six-module toolkit whose fake lock screen harvests the domain password its own tunnel then uses from the victim's IP
    active-threatsSynkLoader pairs a fake Windows lock screen with a backconnect proxy, so the stolen domain password is used from the victim's own address
  3. 2026-07-29STAC4749 runs Teams helpdesk vishing from attacker-owned .top domains into certificate-pinned Golang implants and Chaos ransomware in under 17 hours
    active-threatsSophos tracks a Teams-vishing cluster that abandoned tenant spoofing for its own domains and pins its C2 to hardcoded issuer certificates
  4. 2026-07-25Microsoft Email Threat Landscape Q2 2026: phishing moves off email into Teams vishing, and attachment lures drift PDF → DOCX
    researchMicrosoft's quarterly email report flags a sustained shift of social engineering into Teams voice-phishing

Where this entity is cited

  • active-threats3
  • research1

Source distribution

  • microsoft.com2 (50%)
  • expel.com1 (25%)
  • sophos.com1 (25%)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

All cited sources (4)

Entries about Microsoft Teams (4)

2026-09-03 · view entry permalink →

HIGHNATOB2

A Teams helpdesk-impersonation campaign installs a Node.js implant (Microsoft detection name: EtherRatz) via a silent MSI, then pivots over WinRM straight to domain controllers and certificate authorities

Microsoft Threat Intelligence documents a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT or helpdesk personnel, pretexts include "Microsoft Security Update," "Spam Filter Update" and "Account Verification," sometimes reinforced with a phone call, and socially engineers the victim into approving a "request control" prompt during a Teams screen-share, or into opening Quick Assist and reading back a connection code (Microsoft Threat Intelligence, 2026-09-02). Once remote control is granted through the legitimate support tool, the operator uses PowerShell inside that same session to silently pull a malicious MSI, disguised with update-themed names and hosted on a widely used cloud-storage platform to blend with legitimate traffic, and installs it via msiexec /qn. The MSI stages a portable Node.js runtime plus a separately encrypted implant file; a deferred MSI custom action launches hidden bootstrap code that decrypts the implant and hands it to Node.js via standard input or a temporary script file, evading controls keyed on unsigned executables or conventional script extensions (Microsoft Threat Intelligence, 2026-09-02). Per-user persistence uses an HKCU Run value or Startup-folder shortcut, both named "EdgeUpdate." The implant polls its command-and-control over randomised HTTPS long-polling and executes returned JavaScript dynamically, performing sandbox and antivirus discovery, periodic screenshot capture, and ADSI-based Active Directory sweeps, enumerating domain-joined servers and harvesting user object and description-attribute content, with randomised sleep jitter to stay quiet. A dormant capability in the analysed implants queries an Ethereum smart contract for an updated command-and-control URL, disabled in the recovered builds, which fall back to a hard-coded server instead (Microsoft Threat Intelligence, 2026-09-02). Microsoft's own Defender detection names for the implant are Trojan:JS/EtherRatz.A!MTB and Trojan:JS/EtherRatz.B!MTB its article does not otherwise name the campaign or the implant. The same detection table names the MSI/loader stage Trojan:JS/SynkLoader.SA and Trojan:Win32/SynkLoader.SA, the family behind a near-identical Teams helpdesk-impersonation chain documented separately on 2026-08-24 (Expel), a detection-level overlap on the loader stage, distinct from the Node.js implant this entry otherwise describes.

The intrusion's most consequential step is lateral movement: operator-issued tasking through the Node.js implant initiates internal WinRM connections on TCP 5985 to a large set of domain-joined systems, explicitly including domain controllers and certificate authorities, activity Microsoft frames as the hallmark of an intrusion that precedes large-scale data theft, extortion or ransomware deployment (Microsoft Threat Intelligence, 2026-09-02). The Node.js/dormant-Ethereum-smart-contract-C2 mechanism overlaps the malware family already tracked as EtherRAT from Red Canary's August monthly round-up, though Microsoft's own reporting never uses that name for this implant; the connection is a mechanistic overlap this entry records, not an identity Microsoft itself asserts.

Triage: an external Microsoft Teams chat or call that leads to a screen-share "request control" approval or a Quick Assist connection-code exchange, particularly one impersonating internal IT, is the point at which this campaign is still stoppable; legitimate internal helpdesk workflows do not typically originate from an external tenant. Downstream, a WinRM connection to a domain controller or certificate authority originating from a non-administrative PowerShell process, or a node.exe process reading a script staged under a user's AppData directory and launched by wscript.exe, are both behaviours normal administrative tooling does not produce.

Microsoft Threat Intelligence has observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT or helpdesk personnel and socially engineer users into granting an interactive remote session.

The analyzed implants also contained dormant logic capable of querying an Ethereum smart contract for an updated C2 URL. This functionality was disabled in the recovered builds, which instead used a hard-coded fallback server.

operator-issued tasking executed through the Node.js backdoor initiated internal remote-management connections over WinRM on TCP port 5985 to a large set of domain-joined systems

Microsoft Threat Intelligence 2026-09-02

Builds on: 2026-08-23/blockchain-dead-drop-c2-commodity-graphspy · 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader

threat03 Sep 05:21Zsingle-sourceOpen finding ↗
Sources: Microsoft Threat Intelligence

2026-08-24 · view entry permalink →

HIGHNATOB2

SynkLoader: a Teams message from a lookalike tenant, an MSI called 'PowerShell Cleaner', and a six-module toolkit whose fake lock screen harvests the domain password its own tunnel then uses from the victim's IP

Expel published an analysis on 2026-08-20 of SynkLoader, a loader it found on 2026-08-18 while investigating an endpoint-detection alert on a scheduled task in a client network, and for which it could find no prior public reference (Expel, 2026-08-20). The name is a play on its breadth, Expel describes it as an "everything but the kitchen sink" approach, and the reason it belongs in front of a public-sector defender is the delivery, not the tooling: the operator arrives over Microsoft Teams, from a <username>@<company>.onmicrosoft.com address (the default mail domain Microsoft 365 assigns a tenant), posing as the target's own IT service desk under a fabricated staff name, and persuades the user to download and install an MSI presented as a "PowerShell Cleaner" and hosted on Azure blob storage, giving the download the appearance of coming from Microsoft. That inverts the direction staff are trained to be suspicious in: the lure is not an external email but an internal-looking chat from support.

Six modules follow, and Expel notes the chain "ships a long chain of attack tools, which bridge multiple separate programming languages, with some modules using as many as three programming languages at once." A system profiler loads a C# module carrying the name of a Microsoft Visual C++ runtime library, which exports functions to run PowerShell in memory through an embedded Python interpreter, and collects hostname, current user, privilege level, running processes, installed services, the Active Directory domain name and (the detail Expel leans on) a count of AD-joined computers. A persistence module is reached through a second fake-runtime-named DLL that maps libraries into memory without writing them to disk, and the way it installs its scheduled task is a deliberate evasion rather than an implementation detail: Expel documents it registering the task through the Task Scheduler COM interface rather than the command-line utility, specifically to sidestep behavioural detections that inspect command-line arguments or watch for the scheduled-task binary being invoked. That matters for hunting, because the usual high-value signal (a suspicious schtasks command line) is exactly what this build avoids producing. PhishLocker renders a counterfeit full-screen Windows lock screen to steal the user's system login credentials, going as far as retrieving the machine's real lock-screen background image from its own on-disk location and re-focusing itself to defeat Alt+Tab; Expel's analysis host gave it away because the fake mimicked Windows 11 while the machine ran Windows 10, producing visible mismatches in clock and icon placement, password-box theming and the absence of the background blur Windows applies when the password prompt has focus. TrafficRedirector is a backconnect proxy using a protocol resembling HTTP CONNECT: it dials out to the operator, waits for an address and port, and then forwards traffic, which Expel states "can enable the threat actors to connect to internet services using the infected machine IP address, bypassing corporate IP allow-listing," and equally lets the operator reach internal services that only listen on the LAN. An interactive shell polls one endpoint for commands and posts results to another. A screen-streaming module written in Python connects outward rather than listening, compresses screenshots and forwards mouse and keyboard input into the live session, notably not a hidden-desktop implementation, so the activity would be visible to a logged-on user; Expel assesses from its unusually formal comments and the absence of any matching open-source project that it was likely AI-assisted.

The two halves that matter together are PhishLocker and TrafficRedirector. Expel's own framing: "When combined with the system password phishing model, threat actors can use the infected user's username and password to log into both internal and external company systems, all without triggering alerts based on logins from unknown IPs or geolocations." A cleartext domain password is also worth more than a hash here because single sign-on turns it into access across every federated application, without the constraints of pass-the-hash or Kerberos relay. Expel assesses at low-to-medium confidence that the toolkit belongs to a ransomware group or an initial-access broker selling to one, resting that on the AD-computer count (which matters most to an actor whose profit scales with the size of the network it disrupts) and on the loader's resemblance to others previously used by such groups. Build timestamps place the components around late July 2026, and one module's debug path leaked the developer's local account name.

Triage: a real IT service desk contacting a user over Teams and asking them to install something is not unusual, which is what makes this work; the discriminators are tenant and provenance, not behaviour. Genuine internal support messages come from a sender inside the organisation's own verified domain, not from an onmicrosoft.com default-domain address belonging to a different tenant, and genuine software arrives through the organisation's own management or software-distribution channel rather than as an operator-supplied link to consumer-facing cloud storage. On the endpoint, an MSI that installs an embedded Python interpreter and DLLs bearing Visual C++ runtime names outside a legitimate application directory is the anomaly; the runtime names are the masquerade, so the signal is the location and the installing parent, not the filename. For the lock-screen module, the honest discriminator is that Windows never asks a user to re-authenticate through a newly launched application: a full-screen credential prompt whose owning process is not the operating system's own logon UI is a fake, and a mismatch between the rendered lock-screen style and the host's actual Windows version is what exposed this one.

The loader ships a long chain of attack tools, which bridge multiple separate programming languages, with some modules using as many as three programming languages at once.

It can enable the threat actors to connect to internet services using the infected machine IP address, bypassing corporate IP allow-listing.

When combined with the system password phishing model, threat actors can use the infected user’s username and password to log into both internal and external company systems, all without triggering alerts based on logins from unknown IPs or geolocations.

Expel 2026-08-20
threat24 Aug 09:13Zsingle-sourceOpen finding ↗
Sources: Expel

2026-07-29 · view entry permalink →

HIGHNATOB2

STAC4749 runs Teams helpdesk vishing from attacker-owned .top domains into certificate-pinned Golang implants and Chaos ransomware in under 17 hours

The initial access here is entirely social, and the interesting part is what the operators changed. Contact comes as a Microsoft Teams chat or call from an IT-support persona; Sophos observed call durations from 90 seconds to over 20 minutes, most lasting two to two and a half (Sophos X-Ops, 2026-07-28). Earlier Teams-abuse campaigns spoofed onmicrosoft.com tenants, which gave defenders a tractable check. STAC4749 instead registers its own IT-themed domains under the .top TLD and populates them with plausible first-name/last-name employee accounts (Sophos X-Ops, 2026-07-28). That moves the detection question from "is this tenant genuinely Microsoft's" to "should this external domain be able to reach our users at all", a policy question rather than a signature one. The persuasion goal is a remote-support session: Quick Assist initially, with the cloud-based RemSupp as fallback, and from April 2026 RemSupp by preference; Sophos assesses this is likely because it is less apt to appear on application blocklists (Sophos X-Ops, 2026-07-28). Lateral movement consistently began by enabling RDP on the initial host through Windows service reconfiguration via msconfig (Sophos X-Ops, 2026-07-28).

Two payload design choices are worth carrying into detection engineering. First, the Python backdoor (PyArmor-obfuscated, PyInstaller-packaged, able to run shell commands, collect system information and load further Python modules) retrieves its AES key and initialisation vector from a public code-hosting repository at runtime and uses them to decrypt its embedded configuration and payload (Sophos X-Ops, 2026-07-28). The key is therefore not in the sample, which defeats static key extraction and lets the operators rotate it by editing a public page. Second, the Golang implants embed CA certificates and will complete an encrypted connection only when the C2 server presents a matching issuer; Sophos found payloads sharing an issuer consistently talked to the same servers while different issuers meant separate infrastructure, and reads this as deliberate segmentation by payload or operational role (Sophos X-Ops, 2026-07-28). The practical effect is that a TLS-terminating proxy or a researcher's redirection attempt cannot complete the handshake, so interception-based analysis and sinkholing both fail unless the issuer is reproduced. Persistence evolved visibly across the campaign: HKCU Run keys masquerading as Realtek audio components from February, joined by WinAudio-themed names from mid-May, alongside .vbs scripts creating Startup-folder shortcuts named to look like SecurityHealth or OneDriveUpdate, sometimes with hidden attributes (Sophos X-Ops, 2026-07-28). In ransomware cases operators added DWAgent and AnyDesk for redundant access, and in one case a standalone reverse-SOCKS proxy supporting up to a thousand concurrent connections; encryption landed nearly simultaneously across endpoints, in one incident under 17 hours from initial access (Sophos X-Ops, 2026-07-28).

Triage: the remote-support tools in this chain are genuine software that IT departments use daily, so the tool itself discriminates nothing, and neither does the fact of an inbound Teams call. The discriminator Sophos's own guidance points at is provenance and initiative: a legitimate support session is requested by the user or arranged against an existing internal ticket, whereas this pattern is an unsolicited approach from an unrecognised external domain followed immediately by pressure to launch or install a remote-access tool. Operationally that means correlating remote-support process starts against your ticketing system, and treating a first-ever external Teams contact followed within minutes by an RMM installation as the sequence to alert on.

STAC4749 operators created IT-themed cloud domains under the ".top" top-level domain (TLD) and leveraged plausible employee usernames to make the accounts appear legitimate

Several of the Golang-based implants contained hard-coded CA certificates associated with issuer names such as loop-CA, connectify-CA, and james-bond-CA. These implants only established encrypted connections if the C2 server had the same issuer as the embedded certificate.

Retrieved its AES key and initialization vector (IV) from a public GitHub repository and used the key to decrypt embedded configuration data and payload

In one incident, the time from initial access to ransomware deployment was less than 17 hours, consistent with prior Chaos ransomware cases observed by Sophos analysts.

Sophos analysts have found no evidence linking STAC4749 activity to that group. Instead, limited hands-on-keyboard artifacts suggest a Russian-language connection.

However, there is insufficient evidence for attribution.

Sophos X-Ops 2026-07-28
threat29 Jul 05:35Zsingle-sourceOpen finding ↗
Sources: Sophos X-Ops

Earlier coverage (1)

2026-07-25NOTABLENATOB2Microsoft Email Threat Landscape Q2 2026: phishing moves off email into Teams vishing, and attachment lures drift PDF → DOCXMicrosoft's Q2 2026 email-threat report quantifies two operationally relevant shifts for M365 tenants: Teams-based voice-phishing (vishing) reached roughly ten times its mid-2025 weekly baseline by quarter-end, and phishing attachment delivery drifted from PDF toward DOC/DOCX as a detection-evasion move. Credential theft remained the objective of 94-96% of payload-based attacks. Includes two concrete campaigns: an automated BEC via Python-scripted Amazon SES and an EML/OAuth-redirect chain delivering a BAT dropper.