Executive Summary
A sophisticated social engineering campaign has been observed abusing Microsoft Teams to gain initial access to corporate networks. Attackers initiate the intrusion with phishing emails containing 'Employee Survey' lures, followed by a Microsoft Teams voice call where they impersonate a 'System Administrator'. By leveraging Teams' built-in screen-sharing and remote-control features, the actors guide victims to install legitimate RMM tools like HopToDesk and AnyDesk before deploying EtherRAT.
EtherRAT is a cross-platform remote access trojan (RAT) written in Node.js that utilizes Ethereum smart contracts for C2 infrastructure resolution, making it highly resilient to traditional domain blocking. The campaign shows high operational maturity, including the use of multi-stage loaders, legitimate ServiceNow ticket creation during the breach to maintain cover, and an active distribution server hosting multiple versions of the malware.