MICROSOFT TEAMS PHISHING: PROTECTING THE NEXT BIG ATTACK VECTOR

4MICROSOF T TE AMS PHISHING: PROTECTING THE NE X T BIG AT TACK VECTOR

A stunning new development in the world of Teams phishing was announced by Microsoft.

An initial access broker that's previously worked with ransomware groups is switching from email to Teams as their way into corporate networks.

The group, known as Storm-0324, is a financially-motivated organization, and has worked with the Fin7 group, which is known for deploying Clop ransomware.

Starting in July, according to Microsoft researchers, Storm-0324 used Teams to send phishing attacks.

According to Microsoft, they used the publicly available tool TeamsPhisher.

We wrote about TeamsPhisher recently. TeamsPhisher first finds a target Teams user, verifying that they can receive external messages. After doing so, TeamsPhisher starts a thread with the target, with a message and a link to a SharePoint attachment.

5MICROSOF T TE AMS PHISHING: PROTECTING THE NE X T BIG AT TACK VECTOR

Here's what it looks like in action:

And then here's the file:

This type of tactic has now been used a few times. We’ve seen it done by the group behind SolarWinds.

According to Microsoft research, the group is sending socially-engineered phishing messages and links via Microsoft Teams. This attack has hit 40 organizations.

Microsoft details the attack working like this: They take previously-compromised tenants, rename them and add an onmicrosoft.com subdomain to add legitimacy.

The idea is to get MFA codes. From there, they're able to get into accounts and do tons of damage. The attacker starts by sending a message to the targeted user, as shown here:

6MICROSOF T TE AMS PHISHING: PROTECTING THE NE X T BIG AT TACK VECTOR

When the end-user says 'accept', they'll receive a second message.

Now, the hacker has the code and can use it for all sorts of post-compromise activity.

And we’ve seen a similar attack that spreads a DarkGate loader via Teams.

Two compromised external users were sending out messages, like this one:

Clicking on the file leads to a download of a zip file from a SharePoint URL. It's a LNK file that's hiding as a PDF file. As a reminder, Check Point Research found that LNK files are up 44% YoY as a delivery mechanism for malicious files.

This document contains a VBscript that leads to a DarkGate Loader.

The DarkGate loader has a number of evasion tools built-in. A great breakdown of DarkGate Loader can be found here.

These attacks represent a shift in attacks. And what's most interesting about this is that Storm-0324, and other groups like it, have changed its tactics.

7MICROSOF T TE AMS PHISHING: PROTECTING THE NE X T BIG AT TACK VECTOR

They have been relying on email as the first step in their campaigns since at least 2019, typically sending emails that spoof invoices or payments. The link on the email goes to a SharePoint site.

That's generally the same here, except the attack starts over Teams. Why the switch?

We've found, in our three years of delivering Teams protection, that there's a few things going on.

One, many organizations don't have Teams protection beyond what Microsoft provides. Forrester notes that, "protections developed for the email inbox must extend to these environments."

And yet, we haven't seen that across the ecosystem of vendors. At most, we'll see configuration visibility and understanding of anomalous logins or behavior.

That's all very valuable, but organizations need to go deeper and that's where groups like Storm-0324 can come in.

Second, we've found that users are generally more trusting on Teams than they are on email. Think about it: have you ever received security awareness training about Teams? If you have, you're one of the few.

This attack takes advantage of the lack of URL scanning and sandboxing from most providers. And it takes advantage of the fact that most end-users aren't scrutinizing external users on Teams. Organizations have countless chats going on with external partners and clients. Receiving a message from an external user isn't unusual--it's standard practice.

We've written about a number of unique Teams attacks in the past. We've seen how hackers have attached malicious .exe files. The file is called "User Centric", but it is in fact a Trojan, which will then install DLL files and create shortcut links to self-administer. This will eventually lead to the hacker taking over the computer.

We've also uncovered partner compromise attacks, where a partner organization had an account that was compromised for almost a year, unbeknown to either companies. This hacker acted differently on Teams. Instead of the traditional spray-and-pray campaigns, the hacker waited nearly a year before contributing in a channel. Instead, they waited and bided their time. When an opportunity arrived and sharing a file was part of a natural conversation, the hacker shared a zip file, which included a version of a malware kit designed for desktop monitoring and configured to install silently upon clicking the file. This Trojan would've given the attacker full access to control the victim's desktop.

Finally, in an analysis of hospitals that use Teams, we found that doctors share patient medical information with practically no limits on the platform. Though medical staff generally know the security rules and risk of sharing sensitive information via email, they tend to ignore those rules on teams. In one extreme case, we identified a Teams channel with roughly 250 end-users, many of which with emails external to the hospital domain. In this channel, sensitive medical information is shared freely. In one case, medical information, procedures and family circumstance of a minor was shared together with name and social security information.

8MICROSOF T TE AMS PHISHING: PROTECTING THE NE X T BIG AT TACK VECTOR

How We Protect Teams With us, every file is scanned in a sandbox for malicious content, as are links within files and messages. When we detect sensitive information, such as social security numbers, it's blocked and the sender is notified.

Additionally, we have a user behavior anomaly engine that identifies suspicious logins and compromised accounts, and then cross-correlates that with other protected SaaS apps to detect compromised accounts, insider threats and insecure configurations.

Beyond that, we have a compliance bot for education, which helps reduce the amount of freely shared sensitive data.

We first launched Teams protection in 2020, envisioning a shift in phishing an malware attacks onto the collaboration platform. We were a little early—but we'd rather be early than late. In the last few months, we've seen more publically reported Teams attack than in the last few years.

The tide is changing. Teams protection is no longer nice to have.

It's a need to have.

Worldwide Headquarters 5 Shlomo Kaplan Street, Tel Aviv 6789159, Israel | Tel: +972-3-753-4599

U.S. Headquarters 959 Skyway Road, Suite 300, San Carlos, CA 94070 | Tel: 1-800-429-4391

www.checkpoint.com

© 2023 Check Point Software Technologies Ltd. All rights reserved.

Bookmark 1 Zero Trust and Why You Should Embrace It