Threat intelligence reports from ReliaQuest and Rapid7 revealed a tactical evolution by Black Basta ransomware affiliates (tracked as Storm-1811) targeting corporate enterprises. The intrusion begins with high-volume subscription bombing, flooding the victim’s inbox with legitimate sign-up confirmations to bury alerts. Exploiting permissive external federation in Microsoft Teams, attackers initiate direct chats from external Entra ID tenants configured with deceptive display names like “Help Desk Support,” masquerading as internal IT staff responding to the spam attack.

Operators coerce the distressed victim into launching native Windows Quick Assist (quickassist.exe) or ScreenConnect, securing interactive desktop access. From this trusted session, attackers execute obfuscated PowerShell stagers to deploy SystemBC proxies and Cobalt Strike beacons. The affiliates then conduct Active Directory discovery, harvest LSASS credentials, escalate privileges, and delete volume shadow copies before deploying Black Basta ransomware across corporate endpoints and hypervisors.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Exploiting default external collaboration boundaries in Microsoft Teams alongside legitimate administrative tools like Quick Assist bypasses email secure gateways and application whitelisting, establishing privileged, interactive access without dropping unverified binaries at the perimeter.
• Bullet 2 — Strategic & Defender Imperative: Security teams must disable unapproved external tenant federation in Microsoft Teams, block or strictly control native remote-assistance tools like quickassist.exe, enforce out-of-band verification workflows for all internal help desk requests, and alert on sudden inbox email-flooding anomalies.