Threats tagged 'microsoft teams phishing'

SynkLoader is a sophisticated modular malware loader that uses multiple programming languages to evade detection. It begins with a Microsoft Teams phishing attack impersonating IT helpdesk staff to trick victims into installing a fake PowerShell cleaner via an MSI installer. The malware operates in memory, using Python, C#, C++, and PowerShell components to profile systems, maintain persistence through scheduled tasks, and deploy a fake Windows lock screen to phish credentials. Additional modules provide reverse proxy capabilities for network tunneling, remote shell, and VNC access, enabling attackers to move laterally and perform hands-on-keyboard operations. The complexity and multi-stage infection chain indicate potential use for ransomware or initial access brokering.

Google Threat Intelligence Group identified a sophisticated intrusion campaign by UNC6692 that combined persistent social engineering with custom malware. The attackers impersonated IT helpdesk personnel via Microsoft Teams, leveraging initial email spam campaigns to create urgency. Victims were tricked into downloading AutoHotKey scripts that installed SNOWBELT, a malicious browser extension establishing persistence through scheduled tasks. The modular SNOW ecosystem enabled deep network penetration: SNOWBELT provided initial access, SNOWGLAZE created encrypted WebSocket tunnels masking traffic as legitimate cloud communications, and SNOWBASIN functioned as a local backdoor for command execution. UNC6692 performed internal reconnaissance, escalated privileges by extracting LSASS memory, and used Pass-The-Hash techniques to access domain controllers. The operation culminated in exfiltration of Active Directory databases and credentials via LimeWire, demonstrating advanced tradecraft abusing legitimate clou...