Microsoft Teams Under Siege: Ransomware Groups Exploit Default Settings for Sneaky Attacks!
Two ransomware groups are exploiting Microsoft 365 services, abusing default settings in Teams to target internal enterprise users. Sophos researchers discovered the tactics in November and December 2024, revealing how attackers pose as tech support to gain access. Organizations should enhance security measures to block these intrusions and protect internal users.
Hot Take:
Apparently, Microsoft Office 365’s new feature is helping ransomware groups organize their own ‘Team-building’ activities – complete with remote control, email bombs, and malware payloads. Who knew collaboration tools could be so…collaborative?
Key Points:
- Two ransomware groups, STAC5143 and STAC5777, are exploiting Microsoft Office 365 services and settings.
- STAC5143 uses Microsoft Teams for remote control and Java-based tools to exploit systems.
- STAC5777 leverages Microsoft Quick Assist for malware deployment and persistence.
- Sophos recommends restricting external Teams calls and remote access applications like Quick Assist.
- Employee awareness is crucial to counter social-engineering tactics used in these attacks.
Already a member? Log in here