Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Summary

Threat actors are abusing Microsoft Teams external collaboration to impersonate IT support and socially engineer users into granting remote access. After gaining access, they deploy a malicious MSI package that installs a portable Node.js runtime and a JavaScript-based implant for C2 and persistence. The campaign also includes hands-on-keyboard activity, Active Directory reconnaissance, and lateral movement through WinRM.

Investigation

Microsoft Threat Intelligence analyzed an intrusion chain that progressed from Teams phishing to lateral movement inside the target environment. The investigation revealed abuse of legitimate tools such as Node.js and WinRM to blend malicious activity with normal operations. Researchers also identified an Ethereum smart contract used for dormant C2 discovery and specific Azure-hosted endpoints used to deliver payloads.

Mitigation

Organizations should implement layered security controls, including phishing-resistant MFA and restrictive Microsoft Teams external access policies. Attack Surface Reduction (ASR) rules should be enabled to block unauthorized script interpreters and downloaded content. WinRM access should also be limited to approved administrative workstations and trusted management systems.

Response

If this activity is detected, organizations should assume credential compromise and prioritize rotating all accessible credentials, including domain administrator accounts. Investigators should identify systems where Node.js or renamed Node.js binaries executed from user-writable directories. Security teams should also review WinRM activity and Microsoft Teams external interaction logs for signs of lateral movement or unauthorized access.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has gained initial access via a spearphishing link. To establish a more persistent and stealthy foothold, they use PowerShell to download a malicious installer (simulated by an MSI) from a remote server. Once the “installation” is complete, the attacker drops a JavaScript-based implant into the user’s LocalAppData folder. To avoid signature-based detection of the JS file, they use the legitimate node.exe binary to execute the script, effectively using a “Living off the Land” technique to run their malicious code.

• Regression Test Script:

  # 1. Setup: Create a dummy MSI and JS file in LocalAppData
  $localAppData = $env:LOCALAPPDATA
  $dummyMsi = "$localAppDataupdate_package.msi"
  $dummyJs = "$localAppDataimplant.js"
  
  New-Item -Path $dummyMsi -ItemType File -Force
  "// Malicious JS Payload" | Out-File -FilePath $dummyJs -Force
  
  # 2. Execution - Step 1: PowerShell Download (Triggers selection1)
  # Using the specific keywords 'download' and 'msi' to ensure rule hit
  Start-Process powershell.exe -ArgumentList "-Command", "Write-Host 'Starting download of msi package...'" -WindowStyle Hidden
  
  # 3. Execution - Step 2: Node.js Execution (Triggers selection2)
  # Using 'LocalAppData' and 'js' to ensure rule hit
  Start-Process node.exe -ArgumentList "$dummyJs" -WorkingDirectory $localAppData

• Cleanup Commands:

  # Remove the dummy files created during simulation
  $localAppData = $env:LOCALAPPDATA
  Remove-Item -Path "$localAppDataupdate_package.msi" -ErrorAction SilentlyContinue
  Remove-Item -Path "$localAppDataimplant.js" -ErrorAction SilentlyContinue