Executive Summary
A sophisticated social engineering campaign is targeting users by impersonating IT support via Microsoft Teams. The threat actor convinces victims to grant remote access using the native Windows Quick Assist utility. Once control is established, the operator manually deploys a malicious MSI installer that facilitates long-term persistence and interactive shell access through a novel two-component relay architecture.
The attack chain leverages DLL sideloading of legitimate signed binaries (such as Kodi or FileZilla) to establish an encrypted C2 channel via AWS API Gateway. To evade detection, the malware uses WMI to break the parent-child process tree when launching a custom reverse shell agent. This agent communicates solely over a local TCP port to the C2 relay, effectively bypassing host-based firewalls and standard network monitoring that may trust the signed parent process.
This campaign is high-impact due to its reliance on trusted cloud infrastructure (AWS S3 and API Gateway) and native administrative tools, which often bypass perimeter defenses. The use of interactive social engineering combined with custom obfuscated C++ agents suggests a determined adversary aiming for deep internal network reconnaissance and potential data exfiltration.