Cybercriminals Exploit Microsoft Teams Calls for Ransomware Attacks

Post Views: 10

Threat actors are leveraging Microsoft Teams voice phishing calls to mimic IT support personnel, enabling unauthorized access to corporate networks and the deployment of Chaos ransomware.

Overview of the Cyberattack

Security researchers have identified a coordinated campaign targeting organizations in North America between February and June 2026. The operation, attributed to a financially motivated group, involved social engineering tactics to trick employees into granting remote access, followed by data exfiltration and ransomware execution.

Impersonation via Microsoft Teams

The attack begins with impersonation of internal IT teams through Microsoft Teams, where attackers contact employees under the guise of addressing technical issues or urgent security updates. To build credibility, they guide victims to initiate remote administration tools such as Microsoft Quick Assist, RemSupp, AnyDesk, and DWAgent.

Initial Access and Bypassing Security Measures

This approach allows threat actors to bypass standard security measures by utilizing legitimate software rather than custom malware during initial contact. Once remote access is established, the attackers execute administrative PowerShell commands to create persistent footholds.

Malware Deployment and Persistence

They deploy custom loaders and Python-based backdoors within hidden directories like AppData\\Roaming. Malware components include registry modifications to ensure persistence, such as adding Run keys and embedding Visual Basic scripts in the Windows Startup folder under deceptive names like Realtek or WinAudio.

Command-and-Control (C2) Communication

For command-and-control (C2) communication, the implants use gRPC protocols to fetch Golang-based payloads, authenticated via unique token arguments. Hardcoded digital certificates are employed to enforce certificate pinning, enabling malicious traffic to mimic legitimate encrypted corporate activity.

Post-Compromise Activities

Post-compromise scripts gather system telemetry, including OS versions, machine identifiers, and user privileges, before enabling Remote Desktop Protocol (RDP) for lateral movement across networks. The campaign demonstrates rapid deployment, with Chaos ransomware activated within 17 hours of initial contact in some cases.

Data Exfiltration and Ransomware Execution

Before encrypting files, attackers exfiltrate sensitive data to cloud storage, leveraging double-extortion tactics. The ransomware encrypts systems and places ransom notes named readme.chaos.txt in affected directories.

Geographic and Industry Impact

Geographic analysis reveals that 50% of targets were in Canada and 44% in the United States. Affected industries include professional services (20%), manufacturing (17%), energy (12%), and construction/engineering (12%). All legal entities targeted specialized in intellectual property (IP) law, suggesting deliberate selection to access confidential data.

Security Recommendations

Security experts advise enterprises to review Microsoft 365 tenant configurations, restricting external domain communications within Teams. Administrators should monitor for unusual remote access activity and implement strict controls over third-party tools. Endpoint detection and response (EDR) solutions are critical for identifying anomalous PowerShell commands and registry modifications. Organizations must also enforce multi-factor authentication and conduct regular security awareness training to mitigate social engineering risks.