#threatreport #HighCompleteness
Sophos MDR tracks two ransomware campaigns using email bombing, Microsoft Teams vishing | 21-01-2025
Source:Key details below ↓

🧑‍💻Actors/Campaigns:
Storm_1811
Carbanak
Stac5143
Stac5777

💀Threats:
Blackbasta, Microsoft_quick_assist_tool, Dllsearchorder_hijacking_technique, Winrm_tool, Nltest_tool, Rpivot_tool, Kryptic, 
🌐Geo: Russia, Netherlands

📚TTPs:
⚔️Tactics: 8
🛠️Technics: 7

🧨IOCs:
 - Email: 1
 - IP: 10
 - File: 34
 - Domain: 1
 - Registry: 1
 - Path: 12
 - Command: 2

💽Software: Microsoft Teams, Microsoft Office 365, Office 365, Outlook, Office365, OpenSSL, Windows registry, Active Directory

🔢Algorithms: 7zip

🔠Functions: Teams

🗂️Win API: GetKeyboardState, GetKeyState

📜Programming Languages: java, python, powershell

💻Platforms: x86

#threatreport:
The text discusses the discovery and analysis of a new threat cluster by Sophos Managed Detection and Response (MDR), which is linked to the playbook of Storm-1811 and connected to the Black Basta ransomware. Sophos MDR is actively responding to incidents involving two separate groups of threat actors who have been using Microsoft Office 365 to target organizations with the intention of stealing data and deploying ransomware. These clusters, identified as STAC5143 and STAC5777, have their own Office 365 service tenants and exploit Microsoft Teams to initiate chats or meetings with internal users.

STAC5777 has overlaps with a known threat group, while STAC5143 represents a new threat cluster mirroring the Storm-1811 playbook with potential connections to threat actors like FIN7, Sangria Tempest, or Carbon Spider. The report aims to provide insights to help defenders detect and block these threats, emphasizing the tactics employed through email bombing, fake tech support calls, social engineering, malware delivery, and remote control tools.

The incidents typically start with targeted individuals receiving a high volume of spam emails, followed by an external Teams call pretending to be from the internal IT team. The attackers then instruct the individuals to allow remote screen control sessions through Teams, enabling them to deploy malware, mostly Python-based backdoors. The threat actors utilize various techniques including email bombing, social engineering, exploiting legitimate services within Office 365, deploying remote control tools, and conducting data exfiltration.

The attackers use a combination of legitimate Microsoft tools and malicious payloads to gain control over the targeted devices. They leverage Quick Assist, PowerShell commands, and malicious DLLs for persistence, credential theft, command-and-control connections, lateral movement, and data exfiltration. Additionally, they attempt to disable security measures like multifactor authentication and tamper with security software.

Furthermore, the threat actors deploy ransomware, such as Black Basta, in some cases, and use encrypted command-and-control connections to remote hosts, including virtual private servers in different countries. The text highlights the use of unsigned drivers, obfuscation techniques, and publicly available tools like RPivot in the attacks, linking the Python-based malware to FIN7/Sangria Tempest.

Sophos has outlined recommendations for organizations to prevent such attacks, including restricting remote access applications like Quick Assist, monitoring inbound Teams and Outlook traffic for potential threats, and deploying specific detections for the identified malware. It is crucial for organizations to enhance their security measures, monitor for suspicious activities, and stay informed about evolving tactics used by threat actors targeting Microsoft Office 365 environments.
#threatreport #HighCompleteness