Attackers have shifted from mass malware to real-time social engineering inside Microsoft Teams, running a nine-step campaign that impersonates IT helpdesk staff to win remote access (often via Quick Assist) and then use DLL sideloading and HTTPS command-and-control to steal selected files and credentials.

How the attack starts

Attackers shift from mass malware to real-time social engineering inside Microsoft Teams. They create a distraction — such as spam or a manufactured mailbox problem — then contact employees from an external Teams account while the target is distracted. The chat impersonates company IT or helpdesk staff and offers immediate assistance to shorten suspicion and prompt cooperation.

  • Why Teams: it's an internal channel employees trust more than unsolicited email, and real-time messages create urgency that lowers guard.
  • Initial ask: attackers commonly request a remote support session (Quick Assist or similar), giving them interactive access to the desktop if accepted.

That interactive foothold converts a social ploy into technical compromise within minutes.

What intruders do once they're in

With a live session, attackers run quick reconnaissance using Command Prompt and PowerShell to check privilege level, domain membership and network reachability. If the host is useful, they drop a small bundle of files into writable locations (ProgramData is commonly abused) and avoid running obvious executables.

Instead, they use DLL sideloading: launching a legitimate signed application already trusted on the endpoint and loading an attacker-supplied DLL in its place so malicious code executes while appearing as normal software. They also modify the Windows Registry to maintain persistence. Outbound connections typically use HTTPS (port 443), blending with normal web traffic and reducing detection chances.

Lateral movement and selective exfiltration

Attackers expand access using native administrative channels such as Windows Remote Management (WinRM) to reach domain-joined systems and higher-value targets. They often install legitimate remote-management tools on additional hosts to retain control.

For data theft, intruders prefer cloud-backed transfer tools like Rclone to upload selected high-value files to external cloud storage. By filtering for targeted data rather than bulk copying, the operation creates less noise and can hide among routine backups and administrative transfers.

Researchers tracking one campaign designated it UNC6692 and described a supporting set of malware components called the SNOW ecosystem. Together, those elements enable reconnaissance, persistence, lateral movement and selective exfiltration while relying on trusted collaboration tools and normal outbound HTTPS traffic to stay stealthy.

Related Articles

Microsoft says the campaign typically begins with an external Teams chat, secures remote-help access — often via Quick Assist — then relies on DLL sideloading and HTTPS command-and-control over port 443 to move laterally and exfiltrate selected data.

This article was created with AI assistance.