Microsoft Teams vishing campaigns target enterprise access to high-value data repositories

Attackers impersonate IT personnel through Teams chats and calls, coercing targets into launching RMM tools or granting OAuth permissions that stage Node.js implants and enable WinRM pivots toward domain controllers. Microsoft documented the pattern as high-impact, with PowerShell downloads of obfuscated JavaScript C2 and periodic screenshot exfiltration. Sophos analysis of the Gentlemen ransomware affiliate playbook shows identical initial access followed by rapid AD reconnaissance and backup tampering, confirming the technique's repeatability across 683 victims.

These operations exploit the same trusted paths and collaboration features that protect court and legal data platforms. Thomson Reuters systems holding sealed documents and SSNs rely on comparable enterprise identity controls; external Teams access combined with NTLM relay variants creates a direct vector for exfiltration without traditional perimeter breaches. Unit 42 tracking of 26 attacker identities and Group-IB persistence of Outsider PaaS after takedowns indicates the tooling remains available to affiliates focused on high-value targets.

Independent technical indicators—malicious MSI packages, BYOVD EDR killers, and WinRM lateral movement—diverge from official attribution claims that often lack packet-level confirmation. The pattern suggests sustained operational interest in data aggregators rather than one-off ransomware deployment.

Defenders must enforce strict external Teams policies, monitor for anomalous RMM launches from help-desk contexts, and validate OAuth grants against known good lists. Next quarter will likely see expanded targeting of legal-tech vendors as affiliate playbooks mature.