New Ghost Calls tactic abuses Zoom and Microsoft Teams for C2 operations
Source Reddit InfoSec News
Germany
France
Netherlands
Sweden
Italy
Spain
Belgium
United Kingdom- infosecnews
- high-priority
- bleepingcomputer.com
- cybersecurity
Description
New Ghost Calls tactic abuses Zoom and Microsoft Teams for C2 operations Source: https://www.bleepingcomputer.com/news/security/new-ghost-calls-tactic-abuses-zoom-and-microsoft-teams-for-c2-operations/
Impact
For European organizations, the Ghost Calls tactic presents a significant threat due to the extensive adoption of Zoom and Microsoft Teams across various sectors including government, finance, healthcare, and critical infrastructure. The abuse of these trusted communication channels for C2 operations can lead to prolonged undetected compromises, enabling attackers to maintain persistence and orchestrate complex attacks. Confidentiality may be compromised through data theft or espionage, integrity could be undermined by unauthorized command execution, and availability might be affected if the botnet is used for disruptive purposes such as DDoS attacks. The stealth nature of this tactic challenges existing security monitoring and incident response capabilities, potentially increasing the dwell time of attackers within networks. Additionally, regulatory compliance obligations under GDPR and other European data protection laws heighten the consequences of breaches stemming from such advanced evasion techniques.
Defensive guidance
European organizations should implement advanced monitoring strategies that include behavioral analysis of communication patterns within Zoom and Microsoft Teams, looking for anomalous call frequencies, durations, or participants that deviate from normal usage. Network segmentation should be enforced to limit the exposure of critical systems to these communication platforms. Deploying endpoint detection and response (EDR) solutions capable of inspecting process behaviors related to these applications can help identify unauthorized use or manipulation. Security teams should collaborate with platform providers to understand and leverage any available telemetry or security features that can flag suspicious activities. Additionally, organizations should enforce strict access controls and multi-factor authentication (MFA) for collaboration tools to reduce the risk of account compromise. Regular user training to recognize social engineering attempts that could facilitate initial access is also essential. Finally, integrating threat intelligence feeds that track emerging C2 techniques can aid in early detection and proactive defense.
Summary
The reported threat involves a novel tactic dubbed 'Ghost Calls,' which leverages popular unified communication platforms, specifically Zoom and Microsoft Teams, to conduct command and control (C2) operations for botnets. This technique abuses the legitimate call functionalities of these platforms to covertly transmit commands and control signals between attackers and compromised systems. By embedding C2 communications within seemingly benign voice or video calls, threat actors can evade traditional network detection mechanisms that monitor for suspicious traffic patterns or known malicious domains. The use of widely adopted collaboration tools complicates detection because such traffic is typically allowed and trusted within enterprise environments. Although no specific affected software versions or vulnerabilities have been identified, the tactic exploits the inherent trust and widespread use of these platforms rather than a software flaw. The absence of known exploits in the wild suggests this is an emerging technique rather than a currently widespread campaign. The minimal discussion level and low Reddit score indicate limited public awareness or technical details at this stage. However, the high severity rating underscores the potential risk posed by this stealthy communication channel for botnet control, which could facilitate data exfiltration, lateral movement, or distributed denial-of-service (DDoS) attacks once fully weaponized.
- Source Type
- Subreddit
- InfoSecNews
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Domain
- bleepingcomputer.com
- Has External Source
- true
References
Community reviews
Related threats
- Over 10K Fortinet firewalls exposed to actively exploited 2FA bypassBreach
- Hackers drain $3.9M from Unleash Protocol after multisig hijackNews
- RondoDox botnet exploits React2Shell flaw to breach Next.js serversBreach
- Disney will pay $10 million to settle children's data privacy lawsuitNews
- IBM warns of critical API Connect auth bypass vulnerabilityCriticalVulnerability