Listen to the episode
TLDR
Attackers are calling employees directly through Microsoft Teams, pretending to be internal IT support, to trick victims into granting remote access. Once inside, they deploy Chaos ransomware, encrypting files across the corporate network...
How it works
Attackers are calling employees directly through Microsoft Teams, pretending to be internal IT support, to trick victims into granting remote access. Once inside, they deploy Chaos ransomware, encrypting files across the corporate network...
Red flags
- : Unexpected Teams call or chat from someone claiming to be from IT or helpdesk Caller pressures you to install remote access software (AnyDesk, TeamViewer, Quick Assist) Urgent requests to reset credentials or disable security tools outside normal ticketing流程
What to do
- 1: Verify any IT support request through a known internal channel before acting Never install remote access tools on a caller's request without ticket confirmation Report suspicious Teams calls to your security team and enable Microsoft Teams external chat restrictions
Source
bleepingcomputer
Source reviewed by Mythos Forensic Team
https://www.bleepingcomputer.com/news/security/microsoft-teams-vishing-attacks-lead-to-chaos-ransomware-attacks/FAQ
Is Microsoft Teams vishing attacks impersonate IT support to deploy Chaos ransomware a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
: Unexpected Teams call or chat from someone claiming to be from IT or helpdesk Caller pressures you to install remote access software (AnyDesk, TeamViewer, Quick Assist) Urgent requests to reset credentials or disable security tools outside normal ticketing流程
What should I do first?
: Verify any IT support request through a known internal channel before acting Never install remote access tools on a caller's request without ticket confirmation Report suspicious Teams calls to your security team and enable Microsoft Teams external chat restrictions
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.