New A0Backdoor Linked to Teams Impersonation and Quick Assist Social Engineering

A new backdoor, dubbed A0Backdoor, has been discovered in connection with a campaign using email bombing and IT-support impersonation over Microsoft Teams to gain Quick Assist access. The malware's loader exhibits anti-sandbox evasion techniques, and the campaign's command-and-control has shifted to a covert DNS mail exchange-based channel. This activity is attributed to the threat group Blitz Brigantine, also known as Storm-1811 or STAC5777, and shows similarities to Black Basta-linked social-engineering tactics. The attackers use digitally signed MSI packages, often hosted on Microsoft cloud storage, to deliver their proprietary tooling. The A0Backdoor employs sophisticated techniques such as time-based execution windows, runtime decryption, and DNS tunneling for covert communication. The campaign has been active since August 2025, targeting primarily the finance and health sectors.

• Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial AccessCampaign2026-10-26
• Managed for Malice: How Attackers Turn MDM into Remote AccessCampaign2026-10-28
• Palo Alto Networks PAN-OS · Operation Master: Deconstructing a Multi-Tiered Intrusion and Monetization PipelineExploitedMalware2026-09-28
• Locked and Loaded: Phishing through Fake Bids and Protected DocumentsCampaign2026-10-27
• Fake Calendly "Meta Careers" pages steal Facebook and Google loginsCampaign2026-10-14