Threat intel
External Teams Chats Anchor Rapid 15-Minute Malware Delivery in Ongoing Campaign
Dark Reading reports on a wide-scale, ongoing social engineering campaign that pairs email bombing with external Microsoft Teams chats to deliver malware in as little as 15 minutes, with possible ties to the Black Basta ransomware gang.
Attackers are abusing external Microsoft Teams chats as a fast path to malware delivery, according to reporting from Dark Reading. The outlet describes a wide-scale, ongoing social engineering campaign in which email bombing tactics are paired with Teams messages, enabling threat actors to move from initial contact to malware delivery in as little as 15 minutes.
Email bombing, in which a target's inbox is flooded with a large volume of messages, has become a familiar precursor to chat- and voice-based social engineering. After overwhelming the victim, attackers typically pose as IT support staff offering to fix the problem, then persuade the target to grant remote access or install malicious software. According to Dark Reading, external Teams chats are now anchoring this approach, giving the campaign a repeatable access path into targeted organizations.
Dark Reading reports that the campaign may be tied to the Black Basta ransomware gang. Black Basta has previously been linked to social engineering operations that combine email flooding with direct contact through collaboration platforms, though based on the available information the attribution in this case remains tentative.
The reported speed of the operation — roughly 15 minutes from initial contact to malware delivery — underscores the pressure on security teams to detect and respond quickly. The campaign also highlights the risks associated with external communication features in collaboration tools such as Microsoft Teams, which can allow people outside an organization to initiate chats with internal staff. Security researchers have repeatedly flagged such features as an attractive avenue for phishing and social engineering.
Details of the campaign, including its scale and the suspected link to Black Basta, come from Dark Reading's reporting.
Source: Dark Reading
