Attackers impersonating “IT Support (Internal)” in Microsoft Teams external chats have been linked to more than 400 intrusions, according to Arctic Wolf, which says payload execution can follow in under 15 minutes. The firm published its analysis on October 26.
The Email Bombing and Teams Impersonation Sequence
Arctic Wolf describes a recurring pattern. Attackers first flood the target with newsletter subscriptions, a technique known as mail bombing. They then contact the victim through a Teams external chat while posing as internal IT support, offering to fix the problem they created.
The attackers target multiple users within five-minute windows. Many of the incidents use the same throwaway tenants, display names and tools, and increasingly the same payload domains.
Remote Access Tools Victims Are Talked Into Starting
Victims are persuaded to start remote sessions, most often with Quick Assist. The attackers also use AnyDesk, ScreenConnect, Atera, Zoho Assist, NetSupport and LogMeIn.
From Remote Session to Domain Credentials
Arctic Wolf outlines a typical chain. The attacker runs whoami and systeminfo for reconnaissance, delivers a PowerShell payload and establishes a command-and-control beacon.
Kerberos Abuse and Lateral Movement
The attacker then moves laterally using Kerberoasting and similar Kerberos abuse, techniques that target authentication tickets in Windows domains.
A Second Remote Tool as a Backup Channel
Finally, the attacker installs a second commercial remote tool that serves as an independent control channel. That channel survives remediation of the first, so cleaning up one tool does not necessarily end the intrusion.
Possible Link to Black Basta
Dark Reading reports that the activity might be tied to the Black Basta ransomware gang. Arctic Wolf’s findings point to possible follow-on credential theft and ransomware, but the source material frames the Black Basta link as a possibility, not a confirmed attribution.
Arctic Wolf’s Indicators and the 15-Minute Window
Arctic Wolf published indicators and a description of the behavior pattern. The count of more than 400 incidents comes from the firm’s own observations, and the report does not say how many victims were later hit with ransomware.
The speed is the defining figure. Reaching payload execution within 15 minutes of first contact leaves a short window for a help desk or a security team to detect the impersonation. The use of well-known commercial remote tools also helps the activity resemble legitimate administration.
Why External Teams Chat Is the Entry Point
The campaign relies on a feature that lets users in one organization receive messages from accounts in another. Attackers register throwaway tenants, choose a display name that reads as internal support and contact staff directly. The mail-bombing step creates a reason for the victim to accept help, since the inbox is already overwhelmed when the “support” message arrives.
The same infrastructure and naming appearing across hundreds of incidents suggests either one operation or a shared playbook. Arctic Wolf’s observation that payload domains are increasingly reused gives defenders matching points, while the attackers’ shift to a second remote tool shows they plan for cleanup.
The numbers frame the scale. More than 400 incidents with the same tenant names, tools and increasingly the same payload domains point to repeated use of one method rather than 400 unrelated operations. The five-minute windows in which multiple users are contacted show the attackers work in bursts, and the 15-minute time to payload execution compresses the period during which an organization could intervene. The list of seven named remote tools (Quick Assist, AnyDesk, ScreenConnect, Atera, Zoho Assist, NetSupport and LogMeIn) shows the attackers are not tied to one product. Arctic Wolf’s chain also ends with the second remote tool, so a victim who removes Quick Assist after the call may still have an attacker session running under a different commercial product. Dark Reading’s report cites the same pattern of reused tenants and payload domains when it raises the possible Black Basta connection, though neither outlet confirms who operates the campaign.
