Threat Actors Weaponize Teams Messaging to Breach Enterprises
TL;DR
UNC6692 runs a multistage intrusion that begins with mass email bombardment and escalates via impersonation of IT staff in Microsoft Teams, guiding victims to a phishing landing page hosted on AWS S3. The campaign then harvests credentials, deploys a modular malware suite (SNOWBELT), and uses cloud-based C2 and data staging to exfiltrate data and compromise domain controllers, highlighting the need to restrict external Teams access and monitor cloud egress and browser extensions for anomalous activity.
Topics:technologycyber-security-news#cyber-security-news#cybersecurity#microsoft-teams#phishing#snowbelt#unc6692
- Hackers Leverage Microsoft Teams to Breach Organizations Posing as IT Helpdesk Staff CyberSecurityNews
- UNC6692 Impersonates IT Help Desk via Microsoft Teams to Deploy SNOW Malware The Hacker News
- Cross‑tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook Microsoft
- Attackers abuse Microsoft Teams to impersonate the IT helpdesk in a new enterprise intrusion playbook csoonline.com
- Researchers Track Teams-Based Social Engineering Campaign By UNC6692 The420.in
Want the full story? Read the original reporting
Read on CyberSecurityNews