Exploring the Implications of the Resurfacing Microsoft Teams Hacks: Storm-0324 and the Rise of TeamsPhisher

The Growing Threat of Phishing Attacks on Microsoft Teams

Introduction

In a recent campaign, a financially-motivated threat actor known as TA543, Storm-0324, or Sagrid targeted organizations using phishing attacks via Microsoft Teams. This highlights the increasing interest of both researchers and hackers in business communication apps, even as workforces return to the office. This report examines the methods used by the threat actor, the vulnerabilities in Teams that allowed them to carry out these attacks, and the implications for organizations. Additionally, it provides advice on protecting against such attacks and the need for robust cybersecurity measures.

The Tactics of the Threat Actor

The threat actor, Storm-0324, previously known for using phishing emails to breach targets, had taken a different approach in this campaign by utilizing Microsoft’s collaboration app, Teams. They used a tool called TeamsPhisher, an open source red-team tool, to trick unsuspecting users and gain unauthorized access. TeamsPhisher simplifies the process of sending phishing messages and files to external Teams tenants. By uploading attachments to the sender’s SharePoint and then sending messages with links to these attachments to target users, the threat actor successfully infiltrated organizations.

Vulnerabilities in Microsoft Teams

Researchers had identified vulnerabilities in Microsoft Teams that allowed for the bypassing of basic security controls and sending files or messages to external tenants. Spoofing and exploiting an insecure direct object reference (IDOR) vulnerability were among the methods used by the threat actor. Microsoft was informed of these vulnerabilities but did not consider them to be immediate concerns. However, red-team developer Alex Reid proved Microsoft wrong by combining the work of previous researchers to create TeamsPhisher, making it easier for threat actors to exploit these vulnerabilities.

The Risk to Organizations

The successful phishing attacks on Microsoft Teams could spell trouble for organizations. Storm-0324 has previously used unauthorized network access to distribute malware and ransomware. By compromising Teams environments, these threat actors can hand over control to notorious financial and ransomware groups, resulting in significant security breaches and potential data loss.

The Increasing Importance of Teams and the Need for Enhanced Security

Microsoft Teams has become a critical communication tool for many organizations, with a significant portion of business communications occurring within the platform. Threat actors recognize the value of targeting such high-traffic cloud workplace channels. The proximity of the application to other apps on a device makes it a potential entry point for cyberattacks, and account compromise is a significant concern. Organizations must acknowledge the potential risks in their Teams environments and take necessary measures to protect against data exfiltration and IP loss.

Protecting Against Teams Threats

Organizations can take several steps to mitigate the risks associated with Teams threats. Toggling off the ability for users in a Microsoft tenant to engage with users of external tenants can prevent attacks like TeamsPhisher. However, this is just the starting point for comprehensive protection. It is essential for organizations to secure users’ account settings and gain full visibility into Microsoft Teams communications. Monitoring for malicious activity and establishing security protocols specific to Microsoft Teams can help organizations quickly identify and respond to threats. Customizable policies and centralized management solutions are crucial for keeping an all-seeing eye on potential risks.

Editorial: The Need for Strong Cybersecurity Measures

The increasing prevalence of phishing attacks on Microsoft Teams highlights the urgent need for organizations to prioritize cybersecurity measures. As more businesses rely on collaboration apps, hackers are following suit by targeting these platforms. Microsoft, as the provider of Teams, must address the vulnerabilities that allow threat actors to exploit the app’s security controls. Patching these vulnerabilities and proactively monitoring for new threats are crucial steps in protecting organizations and their sensitive data.

Conclusion

Phishing attacks on Microsoft Teams, such as the one carried out by the threat actor Storm-0324, present significant risks to organizations. The vulnerabilities in Teams that allowed for these attacks need to be addressed, and organizations must focus on enhancing their cybersecurity measures. Protecting account settings, monitoring for malicious activity, and establishing security protocols specific to Microsoft Teams are essential steps to mitigate such threats. By prioritizing cybersecurity, organizations can minimize the potential damage from phishing attacks and safeguard their sensitive information.