- Trend Micro says hackers are using Microsoft teams to get closer to their victims
- Through Social Technology, they obtain credentials for Remote Desktop Solutions
- This access is then used to drop advanced back doors
Hackers use advanced social technical tactics to try to become deficient .dll files on people’s computers, which in turn would allow them to drop malware to the back door.
A new report from cybersecurity scientists Trend Micro claims that the new attack starts on Microsoft teams, where Crooks uses imitation to get close to the victims and fool them into giving a particular set of credentials. Through fast assistant or similar remote desktop tools, they get access to the devices where the side -loads defective .DLL files that use one -derivance Standaloneupdater.exe, a legitimate OneDrive Update Tool.
These .dll files then allow them to drop backconnect, a type of remote access tool (rat) that establishes a reverse connection from an infected device to an attacker’s server bypassing Firewall constraints. This allows attackers to maintain sustained access, perform commands and exfiltrate data while avoiding traditional security measures.
Commercial cloud solutions
Backconnect is apparently hosted and distributed using commercial sky storage tools.
Trend Micro says the attacks started in October 2024 and have mostly focused on North America, where it observed 21 violations – 17 in the United States, five in Canada and the UK and 18 in Europe. The researchers did not say if the attacks were successful or which industries they targeted the most.
Since most of the tools used in this campaign are legitimate (teams, one -derivance standaloneup dates, Quick Assist), traditional antivirus or malware protection services will not be sufficient. Instead, companies need to educate their employees to see social technical attacks and report them in a timely manner. Companies could also enforce the use of multifactor approval (MFA) and limit access to remote desktop tools.
Finally, they should revise Cloud storage configurations to prevent unauthorized access and monitor network traffic for suspicious connections, especially those who go to known malicious C2 servers.
Via Infosecurity Magazine
