Microsoft Teams Users Under Attack in new Malware Campaign

guest · Nov 11, 2020

Microsoft Teams Users Under Attack in ‘FakeUpdates’ Malware Campaign
November 10, 2020
https://threatpost.com/microsoft-teams-fakeupdates-malware/161071/

Attackers are using ads for fake Microsoft Teams updates to deploy backdoors, which use Cobalt Strike to infect companies’ networks with malware.

The campaign is targeting various types of companies, with recent targets in the K-12 education sector, where organizations are currently dependent on using apps like Teams for videoconferencing due to COVID-19 restrictions.
Microsoft is warning its customers about the so-called “FakeUpdates” campaigns in a non-public security advisory, according to a report in Bleeping Computer.

Cobalt Strike is a commodity attack-simulation tool that’s used by attackers to spread malware, particularly ransomware.
Click to expand...

Microsoft offered a number of mitigation techniques for the latest wave of FakeUpdates attacks. The company is recommending that people use web browsers that can filter and block malicious websites, and ensure that local admin passwords are strong and can’t easily be guessed.
Click to expand...

Bleeping Computer: Fake Microsoft Teams updates lead to Cobalt Strike deployment

Microsoft says that in many cases the initial payload was Predator the Thief infostealer, which sends the attacker sensitive information like credentials, browser, and payment data. Other malware distributed this way includes Bladabindi (NJRat) backdoor, and ZLoader stealer.

The malware also downloaded other payloads, with Cobalt Strike beacons being among them, thus allowing the attacker to discover how they could move laterally across the network.
Click to expand...

Log in or Sign up

Microsoft Teams Users Under Attack in new Malware Campaign

guest Guest

Log in or Sign up

Microsoft Teams Users Under Attack in new Malware Campaign

guest Guest

Useful Searches