Executive Summary
Arctic Wolf has identified a high-velocity campaign linked to the Black Basta ransomware group involving over 400 intrusions. The attackers utilize a sophisticated social engineering sequence, beginning with 'mail bombing' (flooding a victim's inbox with newsletters) followed by immediate contact via Microsoft Teams external chats. Posing as internal IT support, they offer to assist with the influx of spam to gain the victim's trust.
Technically, the attack moves from initial contact to payload execution in under 15 minutes. Attackers persuade victims to launch legitimate remote monitoring and management (RMM) tools like Quick Assist and AnyDesk. Once access is gained, they conduct local reconnaissance, perform Kerberoasting for lateral movement, and establish persistence using a secondary RMM tool as a backup channel. This methodology allows the threat actor to maintain access even if the primary session is terminated by the user or security teams.
This campaign is highly effective due to the abuse of Microsoft Teams' external communication features and the use of legitimate commercial software, which evades many traditional security controls. The speed of the attack chain necessitates rapid detection and intervention, as the window for mitigation is extremely narrow once the victim accepts the external chat request.