2026-09-03 · view entry permalink →
A Teams helpdesk-impersonation campaign installs a Node.js implant (Microsoft detection name: EtherRatz) via a silent MSI, then pivots over WinRM straight to domain controllers and certificate authorities
Microsoft Threat Intelligence documents a human-operated intrusion campaign that abuses Microsoft Teams external
collaboration to impersonate IT or helpdesk personnel, pretexts include "Microsoft Security Update," "Spam Filter
Update" and "Account Verification," sometimes reinforced with a phone call, and socially engineers the victim into
approving a "request control" prompt during a Teams screen-share, or into opening Quick Assist and reading back a
connection code
(Microsoft Threat Intelligence, 2026-09-02).
Once remote control is granted through the legitimate support tool, the operator uses PowerShell inside that same
session to silently pull a malicious MSI, disguised with update-themed names and hosted on a widely used
cloud-storage platform to blend with legitimate traffic, and installs it via msiexec /qn. The MSI stages a
portable Node.js runtime plus a separately encrypted implant file; a deferred MSI custom action launches hidden
bootstrap code that decrypts the implant and hands it to Node.js via standard input or a temporary script file,
evading controls keyed on unsigned executables or conventional script extensions
(Microsoft Threat Intelligence, 2026-09-02).
Per-user persistence uses an HKCU Run value or Startup-folder shortcut, both named "EdgeUpdate." The implant polls
its command-and-control over randomised HTTPS long-polling and executes returned JavaScript dynamically, performing
sandbox and antivirus discovery, periodic screenshot capture, and ADSI-based Active Directory sweeps, enumerating
domain-joined servers and harvesting user object and description-attribute content, with randomised sleep jitter to
stay quiet. A dormant capability in the analysed implants queries an Ethereum smart contract for an updated
command-and-control URL, disabled in the recovered builds, which fall back to a hard-coded server instead
(Microsoft Threat Intelligence, 2026-09-02).
Microsoft's own Defender detection names for the implant are Trojan:JS/EtherRatz.A!MTB and Trojan:JS/EtherRatz.B!MTB
its article does not otherwise name the campaign or the implant. The same detection table names the MSI/loader
stage Trojan:JS/SynkLoader.SA and Trojan:Win32/SynkLoader.SA, the family behind a near-identical Teams
helpdesk-impersonation chain documented separately on 2026-08-24 (Expel), a detection-level overlap on the loader
stage, distinct from the Node.js implant this entry otherwise describes.
The intrusion's most consequential step is lateral movement: operator-issued tasking through the Node.js implant initiates internal WinRM connections on TCP 5985 to a large set of domain-joined systems, explicitly including domain controllers and certificate authorities, activity Microsoft frames as the hallmark of an intrusion that precedes large-scale data theft, extortion or ransomware deployment (Microsoft Threat Intelligence, 2026-09-02). The Node.js/dormant-Ethereum-smart-contract-C2 mechanism overlaps the malware family already tracked as EtherRAT from Red Canary's August monthly round-up, though Microsoft's own reporting never uses that name for this implant; the connection is a mechanistic overlap this entry records, not an identity Microsoft itself asserts.
Triage: an external Microsoft Teams chat or call that leads to a screen-share "request control" approval or a
Quick Assist connection-code exchange, particularly one impersonating internal IT, is the point at which this
campaign is still stoppable; legitimate internal helpdesk workflows do not typically originate from an external
tenant. Downstream, a WinRM connection to a domain controller or certificate authority originating from a
non-administrative PowerShell process, or a node.exe process reading a script staged under a user's AppData
directory and launched by wscript.exe, are both behaviours normal administrative tooling does not produce.
Microsoft Threat Intelligence has observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT or helpdesk personnel and socially engineer users into granting an interactive remote session.
The analyzed implants also contained dormant logic capable of querying an Ethereum smart contract for an updated C2 URL. This functionality was disabled in the recovered builds, which instead used a hard-coded fallback server.
operator-issued tasking executed through the Node.js backdoor initiated internal remote-management connections over WinRM on TCP port 5985 to a large set of domain-joined systems
Builds on: 2026-08-23/blockchain-dead-drop-c2-commodity-graphspy · 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader