MalwarePublished 18 Jul 2025Updated 17 Aug 2025

From a Teams Call to a Ransomware Threat: Matanbuchus 3.0 MaaS Levels Up

Source AlienVault OTX General

Description

Matanbuchus 3.0, a malware loader available as Malware-as-a-Service, has evolved with significant updates. It now employs sophisticated techniques including improved communication protocols, in-memory stealth capabilities, enhanced obfuscation, and support for WQL queries, CMD, and PowerShell reverse shells. The loader collects detailed system data, including information on EDR security controls, to tailor subsequent attacks. It can execute various commands through regsvr32, rundll32, msiexec, or process hollowing. The malware establishes persistence through scheduled tasks and registry modifications. Recent campaigns have targeted victims through external Microsoft Teams calls impersonating IT helpdesks, leading to potential ransomware compromises.

Impact

For European organizations, the threat posed by Matanbuchus 3.0 is considerable. The use of Microsoft Teams—a widely adopted collaboration platform across Europe—as an initial attack vector exploits trust in internal communications, increasing the risk of successful social engineering. Once inside, the malware’s ability to evade detection and gather detailed system and security posture information enables attackers to deploy ransomware tailored to maximize damage and disruption. This can lead to significant operational downtime, data loss, financial costs related to ransom payments or recovery, and reputational damage. Critical sectors such as finance, healthcare, manufacturing, and government entities in Europe are particularly vulnerable due to their reliance on Microsoft Teams and the critical nature of their operations. Furthermore, the malware’s persistence mechanisms and use of legitimate Windows processes complicate incident response and remediation efforts. The threat also raises concerns about compliance with European data protection regulations, such as GDPR, given the potential for data breaches and unauthorized data access.

Defensive guidance

European organizations should implement targeted mitigation strategies beyond generic advice: 1) Enhance user awareness and training specifically addressing social engineering attacks via collaboration tools like Microsoft Teams, emphasizing verification of unexpected IT support requests. 2) Enforce strict access controls and multi-factor authentication (MFA) on Microsoft Teams and related Office 365 accounts to reduce the risk of account compromise. 3) Deploy advanced endpoint detection solutions capable of monitoring and analyzing the use of legitimate Windows utilities (regsvr32, rundll32, msiexec) and detecting anomalous process hollowing or in-memory execution techniques. 4) Implement network segmentation and restrict outbound network traffic to known and trusted domains and IPs, including monitoring for connections to suspicious domains identified in the indicators (e.g., bretux.com, emorista.org). 5) Regularly audit scheduled tasks and registry entries for unauthorized persistence mechanisms. 6) Use threat intelligence feeds to update detection signatures with the provided hashes and indicators of compromise (IOCs). 7) Conduct regular security posture assessments focusing on EDR configurations and ensure they are optimally tuned to detect stealthy malware behaviors. 8) Establish incident response playbooks that include scenarios involving collaboration platform-based social engineering and MaaS loaders.

Indicators of compromise

Domains 5

bretux.com
emorista.org
fixuplink.com
nicewk.com
notepad-plus-plu.org

IP addresses 1

CC=RU ASN=AS49531 netcom-r llc

94.159.113.33

Hashes 13

6847aa8ea6a8b7eb11d3c139ef0ea898MD5 of da9585d578f367cd6cd4b0e6821e67ff02eab731ae78593ab69674f649514872
6ea9ef63b75a79f0be704ea1b4e51bcbMD5 of 211cea7a5fe12205fee4e72837279409ace663567c5b8c36828a3818aabef456
a54fd38b7c6e421a7a0c68e763b69fcbMD5 of 19fb41244558f3a7d469b79b9d91cd7d321b6c82d1660738256ecf39fe3c8421
a86c153cfb39fc0bbaf573acaef27f93MD5 of 0f41536cd9982a5c1d6993fac8cd5eb4e7f8304627f2019a17e1aa283ac3f47c
15e5f79a70d9fc6c92931211a09101d892e7cf93SHA1 of da9585d578f367cd6cd4b0e6821e67ff02eab731ae78593ab69674f649514872
1ff08496b459903acaf475ad39d0387e44b4d721SHA1 of 0f41536cd9982a5c1d6993fac8cd5eb4e7f8304627f2019a17e1aa283ac3f47c
6cc7d7e83200f90ed53e01afc1d0305579ef538eSHA1 of 19fb41244558f3a7d469b79b9d91cd7d321b6c82d1660738256ecf39fe3c8421
df8e256d04ca10e52ce21f021f032fd182615f68SHA1 of 211cea7a5fe12205fee4e72837279409ace663567c5b8c36828a3818aabef456
0f41536cd9982a5c1d6993fac8cd5eb4e7f8304627f2019a17e1aa283ac3f47c
19fb41244558f3a7d469b79b9d91cd7d321b6c82d1660738256ecf39fe3c8421

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 18 Jul 2025, 09:16 UTC

MITRE ATT&CK techniques20 from threat tags

Technical details

Indicators of compromise

Domains 5

IP addresses 1

Hashes 13

Community reviews

Related threats