As cited
Copy frozen at (site build).
threat intel
Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
Microsoft Threat Intelligence has documented a human-operated intrusion campaign that impersonates IT support via Microsoft Teams to trick users into granting remote access, then installs a malicious MSI package containing a Node.js-based JavaScript implant for persistent command execution. After establishing a foothold, threat actors perform Active Directory reconnaissance, take desktop screenshots, and pivot laterally via Windows Remote Management (WinRM) toward high-value targets such as domain controllers and certificate authorities. The campaign relies entirely on legitimate tools and protocols, including Teams, remote support software, PowerShell, and administrative binaries, to avoid detection while building toward data theft, ransomware deployment, or other post-compromise objectives.
Why it matters: Enterprise security teams must defend against social engineering on collaboration platforms: users can be tricked into voluntarily granting interactive remote access to external threat actors posing as IT personnel, creating a direct pathway to domain-wide compromise without exploiting platform vulnerabilities.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
Microsoft Threat Intelligence has documented a human-operated intrusion campaign that impersonates IT support via Microsoft Teams to trick users into granting remote access, then installs a malicious MSI package containing a Node.js-based JavaScript implant for persistent command execution. After establishing a foothold, threat actors perform Active Directory reconnaissance, take desktop screenshots, and pivot laterally via Windows Remote Management (WinRM) toward high-value targets such as domain controllers and certificate authorities. The campaign relies entirely on legitimate tools and protocols, including Teams, remote support software, PowerShell, and administrative binaries, to avoid detection while building toward data theft, ransomware deployment, or other post-compromise objectives.
Why it matters: Enterprise security teams must defend against social engineering on collaboration platforms: users can be tricked into voluntarily granting interactive remote access to external threat actors posing as IT personnel, creating a direct pathway to domain-wide compromise without exploiting platform vulnerabilities.
- Source published
- First seen by Cybersecurity Tracker