Big Trouble in Little Teams

The Funny Summary

Cybercriminals have discovered that pretending to be “IT support” in Microsoft Teams is apparently easier than getting everyone to read the security policy. KongTuke is now using Teams chats to sweet-talk staff into running dodgy PowerShell commands, proving once again that the scariest thing in cybersecurity is still a helpful employee with admin prompts and good intentions.

The Top (5) Takeaways

1. Teams is now part of the phishing playground
   KongTuke has shifted into Microsoft Teams for social engineering, using direct chats to impersonate IT or help-desk staff.

2. The attack can move frighteningly fast
   ReliaQuest observed cases where a single external Teams chat led from cold outreach to persistent access in under five minutes.

3. The trick is simple: convince the user to run PowerShell
   Victims are persuaded to paste and execute a malicious PowerShell command, which ultimately delivers ModeloRAT malware.

4. ModeloRAT is not just a one-trick malware pony
   The malware can collect system and user information, capture screenshots, and exfiltrate files from the host filesystem.

5. The campaign is designed for persistence and resilience
   The newer ModeloRAT activity includes multiple access paths, fallback command-and-control infrastructure, self-update capability, and several persistence mechanisms.

The Long-From Article

Reference:

https://www.bleepingcomputer.com/news/security/kongtuke-hackers-now-use-microsoft-teams-for-corporate-breaches/