Microsoft Teams pushes EtherRAT malware with fake IT support phone calls

Attackers are impersonating company IT help workers and exploiting Microsoft Groups voice calls to trick workers into putting in EtherRAT malware, giving attackers preliminary entry to company networks.

The marketing campaign, reported by Palo Alto Networks Unit 42, makes use of a mixture of phishing emails, Microsoft Groups voice calls, respectable distant administration instruments, and a Node.js-based malware loader to infiltrate victims’ computer systems.

In keeping with a Unit 42 report posted on GitHub, the assault started with a phishing e-mail containing an “worker survey” lure and a malicious PDF attachment.

Instantly after opening the doc, the sufferer receives a Microsoft Groups voice name from an exterior account impersonating a “system administrator.”

Researchers noticed that Groups classes displayed an “exterior and unfamiliar” label. This means that the caller is in a distinct Microsoft 365 tenant than the recipient. Audit logs present that the attacker initiated an exterior chat utilizing the account helpdesk@Progressive936.onmicrosoft(.)com whereas posing as IT help.

After convincing victims to permit distant management by Microsoft Groups’ built-in display sharing characteristic, the attackers satisfied them to put in respectable distant entry instruments similar to HopToDesk and AnyDesk.

After establishing distant entry, it downloaded and executed a malicious MSI installer (v7.msi) from camorreado(.)click on. The MSI acts as a malware loader, downloading the respectable Node.js runtime, decrypting the embedded payload, and at last launching EtherRAT.

EtherRAT is a cross-platform distant entry Trojan written in Node.js that permits attackers to take full management of a compromised system.

The malware makes use of Ethereum sensible contracts to acquire an lively command and management (C2) server whereas having the ability to execute instructions, manipulate recordsdata, steal information, and preserve persistence, making it tough to destroy.

EtherRAT has beforehand been utilized in state-sponsored assaults that exploited vulnerabilities in React2Shell, and has since been adopted by many different risk actors.

Unit 42 mentioned it discovered open directories on distribution servers containing a number of variations of the malware installer (v1 to v9), indicating that this marketing campaign is lively.

Groups assault forces Microsoft so as to add new protections

The newest marketing campaign comes as a rising variety of assaults exploit Microsoft Groups to infiltrate company networks.

In March, a marketing campaign focused monetary and healthcare organizations, spamming victims’ inboxes and contacting them by way of Microsoft Groups posing as firm IT workers. Victims had been tricked into beginning a Fast Help session, which finally led to the introduction of the newly documented A0Backdoor malware.

A month later, Microsoft warned that attackers are more and more abusing exterior Microsoft Groups to impersonate assist desk personnel and persuade workers to grant distant entry to their gadgets. As soon as contained in the community, attackers carry out reconnaissance, unfold laterally to different gadgets, and finally exfiltrate information.

To guard towards these assaults, Microsoft is including new protections to Groups.

Earlier this yr, the corporate added warnings to determine exterior callers and chats to guard towards potential phishing/vishing assaults.

Final week, Microsoft additionally launched a brand new Groups admin coverage that routinely locations suspicious third-party bots in assembly lobbies till the host manually approves them to affix.