Executive Summary
In early 2026, threat actors linked to BlackSuit and Black Basta variants launched widespread campaigns utilizing a sophisticated social engineering kill chain targeting the legal sector and other industries. The attack begins with a 'mailbox bombing' phase to overwhelm the user, followed by a vishing call via Microsoft Teams from a fake IT persona. Victims are guided through Microsoft Quick Assist to download a payload, eventually leading to the execution of Nimbus RAT, a Java-based implant.
Technically, the campaign is notable for its use of legitimate infrastructure to evade detection. Nimbus RAT uses Google Drive and Google Sheets for its command-and-control (C2) channel, masking malicious traffic as benign API calls. The malware bundles its own OpenJDK runtime and supports in-memory second-stage code execution, making it highly portable and stealthy. Additional tooling, such as InboxSetupPro, has been observed targeting encrypted messaging local stores like Signal Desktop.
This activity represents a significant scaling of Teams-based initial access, with telemetry showing an 8x surge in malicious Teams activity in February 2026. Organizations must prioritize hardening Teams configurations and monitoring for the distinct behavioral patterns associated with this multi-stage social engineering playbook.