Organizations Hit by Phishing Attacks via Microsoft Teams

Microsoft has issued an urgent warning regarding a sophisticated phishing campaign targeting organizations using Microsoft Teams, perpetrated by the notorious threat actor group Storm-0324. In a newly detailed report, Microsoft disclosed that since July 2023, Storm-0324 has begun attempting to distribute malicious payloads through external Teams messages, which could then be used to facilitate ransomware attacks.

The mechanism behind these phishing efforts is an open-source tool, TeamsPhisher, which capitalizes on a previously identified but unaddressed security flaw within Microsoft Teams. This tool allows attackers to attach files to messages to external Teams users, thus allowing for malicious payloads to be attached.

Acting as an access broker, Storm-0324 facilitates the entrance of other malicious actors into compromised networks. Historically, the group has been associated with distributing ransomware strains like Sage and GandCrab. Recently, the threat actor has primarily been known for distributing JSSLoader malware to facilitate access for the ransomware-as-a-service group Sangria Tempest (also known as ELBRUS, Carbon Spider, and FIN7).

It's not just corporations that are under threat. In a concerning twist, APT29, a hacking division of the Russian Foreign Intelligence Service (SVR), was found exploiting the same flaw to target organizations, including government entities. Their modus operandi involved tricking targets into approving multifactor authentication (MFA) prompts, ultimately aiming to steal their credentials. With the network compromised, the politically-motivated hacking group could perform espionage undetected.

Responding to the threat, Microsoft has taken several actions. Accounts that have been detected to be partaking in this malicious behavior have been suspended. In addition, Microsoft has attempted to make it more clear when a message is coming from a user outside your organization.

On the user's end, Microsoft advises restricting external communications on Teams if it isn’t necessary, controlling the types of devices that can connect to Teams, educating employees about social engineering, and much more. Microsoft’s full list of recommendations can be found in its report.