{"id":134322,"date":"2024-05-15T09:00:00","date_gmt":"2024-05-15T16:00:00","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=134322"},"modified":"2024-06-05T14:00:02","modified_gmt":"2024-06-05T21:00:02","slug":"threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2024\/05\/15\/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware\/","title":{"rendered":"Threat actors misusing Quick Assist in social engineering attacks leading to ransomware"},"content":{"rendered":"\n
\nJune 2024 update<\/strong>: At the end of May 2024, Microsoft Threat Intelligence observed Storm-1811 using Microsoft Teams as another vector to contact target users. Microsoft assesses that the threat actor uses Teams to send messages and initiate calls in an attempt to impersonate IT or help desk personnel. This activity leads to Quick Assist misuse, followed by credential theft using EvilProxy, execution of batch scripts, and use of SystemBC for persistence and command and control.<\/p>\n<\/blockquote>\n\n\n\n
Since mid-April 2024, Microsoft Threat Intelligence has observed the threat actor Storm-1811 misusing the client management tool Quick Assist<\/a> to target users in social engineering attacks. Storm-1811 is a financially motivated cybercriminal group known to deploy Black Basta ransomware. The observed activity begins with impersonation through voice phishing (vishing<\/a>), followed by delivery of malicious tools, including remote monitoring and management (RMM) tools like ScreenConnect and NetSupport Manager, malware like Qakbot, Cobalt Strike, and ultimately Black Basta ransomware.<\/p>\n\n\n
\n\t\n\t\t\n\t\t\tMITIGATE THIS THREAT \t\t<\/p>\n\t\t\n\t\t\tGet recommendations<\/span> <\/span>\n\t\t<\/a>\n\t<\/div>\n<\/div>\n\n\n\n
Quick Assist is an application that enables a user to share their Windows or macOS device with another person over a remote connection. This enables the connecting user to remotely connect to the receiving user’s device and view its display, make annotations, or take full control, typically for troubleshooting. Threat actors misuse Quick Assist features to perform social engineering attacks by pretending, for example, to be a trusted contact like Microsoft technical support or an IT professional from the target user\u2019s company to gain initial access to a target device.<\/p>\n\n\n
\n\t\n\t\t\n\t\t\tRANSOMWARE AS A SERVICE\t\t<\/p>\n\t\t\n\t\t\tProtect users and orgs<\/span> <\/span>\n\t\t<\/a>\n\t<\/div>\n<\/div>\n\n\n\n
In addition to protecting customers from observed malicious activity, Microsoft is investigating the use of Quick Assist in these attacks and is working on improving the transparency and trust between helpers and sharers, and incorporating warning messages in Quick Assist to alert users about possible tech support scams. Microsoft Defender for Endpoint detects components of activity originating from Quick Assist sessions as well as follow-on activity, and Microsoft Defender Antivirus detects the malware components associated with this activity.<\/p>\n\n\n
\n\t\n\t\t\n\t\t\tTECH SUPPORT SCAMS\t\t<\/p>\n\t\t\n\t\t\tReport scam<\/span> <\/span>\n\t\t<\/a>\n\t<\/div>\n<\/div>\n\n\n\n
Organizations can also reduce the risk of attacks by blocking or uninstalling<\/a> Quick Assist and other remote management tools if the tools are not in use in their environment. Quick Assist is installed by default on devices running Windows 11. Additionally, tech support scams<\/a> are an industry-wide issue where scammers use scare tactics to trick users into unnecessary technical support services. Educating users on how to recognize such scams can significantly reduce the impact of social engineering attacks<\/a>. <\/p>\n\n\n\n
Social engineering<\/h2>\n\n\n\n
One of the social engineering techniques used by threat actors to obtain initial access to target devices using Quick Assist is through vishing attacks. Vishing attacks are a form of social engineering that involves callers luring targets into revealing sensitive information under false pretenses or tricking targets into carrying out actions on behalf of the caller.<\/p>\n\n\n\n
For example, threat actors might attempt to impersonate IT or help desk personnel, pretending to conduct generic fixes on a device. In other cases, threat actors initiate link listing attacks \u2013 a type of email bombing attack<\/a>, where threat actors sign up targeted emails to multiple email subscription services to flood email addresses indirectly with subscribed content. Following the email flood, the threat actor impersonates IT support through phone calls to the target user, claiming to offer assistance in remediating the spam issue.<\/p>\n\n\n\n
At the end of May 2024, Microsoft observed Storm-1811 using Microsoft Teams to send messages to and call target users. Tenants created by the threat actor are used to impersonate help desk personnel with names displayed as \u201cHelp Desk\u201d, \u201cHelp Desk IT\u201d, \u201cHelp Desk Support\u201d, and \u201cIT Support\u201d. Microsoft has taken action to mitigate this by suspending identified accounts and tenants associated with inauthentic behavior. Apply security best practices for Microsoft Teams<\/a> to safeguard Teams users.<\/p>\n\n\n\n
During the call, the threat actor persuades the user to grant them access to their device through Quick Assist. The target user only needs to press CTRL + Windows + Q and enter the security code provided by the threat actor, as shown in the figure below.<\/p>\n\n\n
Figure 1. Quick Assist prompt to enter security code<\/em><\/figcaption><\/figure>\n\n\n\n After the target enters the security code, they receive a dialog box asking for permission to allow screen sharing. Selecting Allow<\/em> shares the user\u2019s screen with the actor.<\/p>\n\n\n
Figure 2. Quick Assist dialog box asking permission to allow screen sharing<\/em><\/figcaption><\/figure>\n\n\n\n Once in the session, the threat actor can select Request Control<\/em>, which if approved by the target, grants the actor full control of the target\u2019s device.<\/em><\/p>\n\n\n
Figure 3. Quick Assist dialog box asking permission to allow control<\/em><\/figcaption><\/figure>\n\n\n\n Follow-on activity leading to Black Basta ransomware<\/h2>\n\n\n\n
Once the user allows access and control, the threat actor runs a scripted cURL command to download a series of batch files or ZIP files used to deliver malicious payloads. Some of the batch scripts observed reference installing fake spam filter updates requiring the targets to provide sign-in credentials. In several cases, Microsoft Threat Intelligence identified such activity leading to the download of Qakbot, RMM tools like ScreenConnect and NetSupport Manager, and Cobalt Strike.<\/p>\n\n\n
Figure 4. Examples of cURL commands to download batch files and ZIP files<\/em><\/figcaption><\/figure>\n\n\n\n Qakbot has been used over the years as a remote access vector to deliver additional malicious payloads that led to ransomware deployment. In this recent activity, Qakbot was used to deliver a Cobalt Strike Beacon attributed to Storm-1811.<\/p>\n\n\n\n
ScreenConnect was used to establish persistence and conduct lateral movement within the compromised environment. NetSupport Manager is a remote access tool used by multiple threat actors to maintain control over compromised devices. An attacker might use this tool to remotely access the device, download and install additional malware, and launch arbitrary commands.<\/p>\n\n\n\n
The mentioned RMM tools are commonly used by threat actors because of their extensive capabilities and ability to blend in with the environment. In some cases, the actors leveraged the OpenSSH tunneling tool to establish a secure shell (SSH) tunnel for persistence. <\/p>\n\n\n\n
After the threat actor installs the initial tooling and the phone call is concluded, Storm-1811 leverages their access and performs further hands-on-keyboard activities such as domain enumeration and lateral movement. <\/p>\n\n\n\n
In cases where Storm-1811 relies on Teams messages followed by phone calls and remote access through Quick Assist, the threat actor uses BITSAdmin<\/a> to download batch files and ZIP files from a malicious site, for example antispam3[.]com<\/em>. Storm-1811 also provides the target user with malicious links that redirect the user to an EvilProxy phishing site to input credentials. EvilProxy<\/a> is an adversary-in-the-middle (AiTM) phishing kit used to capture passwords, hijack a user\u2019s sign-in session, and skip the authentication process. Storm-1811 was also observed deploying SystemBC<\/a>, a post-compromise commodity remote access trojan (RAT) and proxy tool typically used to establish command-and-control communication, establish persistence in a compromised environment, and deploy follow-on malware, notably ransomware.<\/p>\n\n\n\n
In several cases, Storm-1811 uses PsExec to deploy Black Basta ransomware throughout the network. Black Basta is a closed ransomware offering (exclusive and not openly marketed like ransomware as a service) distributed by a small number of threat actors who typically rely on other threat actors for initial access, malicious infrastructure, and malware development. Since Black Basta first appeared in April 2022, Black Basta attackers have deployed the ransomware after receiving access from Qakbot and other malware distributors, highlighting the need for organizations to focus on attack stages prior to ransomware deployment to reduce the threat. In the next sections, we share recommendations for improving defenses against this threat, including best practices when using Quick Assist and mitigations for reducing the impact of Black Basta and other ransomware.<\/p>\n\n\n\n
Recommendations<\/h2>\n\n\n\n
Microsoft recommends the following best practices to protect users and organizations from attacks and threat actors that misuse Quick Assist:<\/p>\n\n\n\n
\n
- Consider blocking or uninstalling<\/a> Quick Assist and other remote monitoring and management tools if these tools are not in use in your environment. If your organization utilizes another remote support tool such as Remote Help<\/a>, block or remove Quick Assist as a best practice. Remote Help is part of the Microsoft Intune Suite<\/a> and provides authentication and security controls for helpdesk connections.<\/li>\n\n\n\n
- Educate users about protecting themselves from tech support scams<\/a>. Tech support scams are an industry-wide issue where scammers use scary tactics to trick users into unnecessary technical support services.<\/li>\n\n\n\n
- Only allow a helper to connect to your device using Quick Assist if you initiated the interaction by contacting Microsoft Support or your IT support staff directly. Don’t provide access to anyone claiming to have an urgent need to access your device.<\/li>\n\n\n\n
- If you suspect that the person connecting to your device is conducting malicious activity, disconnect from the session immediately and report to your local authorities and\/or any relevant IT members within your organization.<\/li>\n\n\n\n
- Users who have been affected by a tech support scam can also use the Microsoft technical support scam form<\/a> to report it.<\/li>\n<\/ul>\n\n\n\n
Microsoft recommends the following mitigations to reduce the impact of this threat:<\/p>\n\n\n\n
\n
- Educate users about protecting personal and business information<\/a> in social media, filtering unsolicited communication, identifying lure links in phishing emails, and reporting reconnaissance attempts and other suspicious activity.<\/li>\n\n\n\n
- Educate users about preventing malware infections<\/a>, such as ignoring or deleting unsolicited and unexpected emails or attachments sent through instant messaging applications or social networks as well as suspicious phone calls.<\/li>\n\n\n\n
- Invest in advanced anti-phishing solutions that monitor incoming emails and visited websites. Microsoft Defender for Office 365<\/a> brings together incident and alert management across email, devices, and identities, centralizing investigations for email-based threats.<\/li>\n\n\n\n
- Educate Microsoft Teams users to verify \u2018External\u2019 tagging on communication attempts from external entities, be cautious about what they share, and never share their account information or authorize sign-in requests over chat.<\/li>\n\n\n\n
- Implement Conditional Access authentication strength<\/a> to require phishing-resistant authentication for employees and external users for critical apps.<\/li>\n\n\n\n
- Apply Microsoft\u2019s security best practices for Microsoft Teams<\/a> to safeguard Teams users.<\/li>\n\n\n\n
- Turn on cloud-delivered protection<\/a> in Microsoft Defender Antivirus or the equivalent for your antivirus product to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block a huge majority of new and unknown variants.<\/li>\n\n\n\n
- Enable network protection<\/a> to prevent applications or users from accessing malicious domains and other malicious content on the internet.<\/li>\n\n\n\n
- Turn on tamper protection<\/a> features to prevent attackers from stopping security services.<\/li>\n\n\n\n
- Enable investigation and remediation<\/a> in full automated mode to allow Defender for Endpoint to take immediate action on alerts to resolve breaches, significantly reducing alert volume.<\/li>\n\n\n\n
- Refer to Microsoft\u2019s human-operated ransomware overview<\/a> for general hardening recommendations against ransomware attacks.<\/li>\n<\/ul>\n\n\n\n
Microsoft Defender XDR customers can turn on attack surface reduction rules<\/a> to prevent common attack techniques:<\/p>\n\n\n\n
\n
- Block executable files from running unless they meet a prevalence, age, or trusted list criterion<\/a><\/li>\n\n\n\n
- Block execution of potentially obfuscated scripts<\/a><\/li>\n\n\n\n
- Block process creations originating from PSExec and WMI commands<\/a><\/li>\n\n\n\n
- Use advanced protection against ransomware<\/a><\/li>\n<\/ul>\n\n\n\n
Detection details<\/h2>\n\n\n\n
Microsoft Defender Antivirus <\/h3>\n\n\n\n
Microsoft Defender Antivirus detects Qakbot downloaders, implants, and behavior as the following malware:<\/p>\n\n\n\n
\n
- TrojanDownloader:O97M\/Qakbot<\/a><\/li>\n\n\n\n
- Trojan:Win32\/QBot<\/a><\/li>\n\n\n\n
- Trojan:Win32\/Qakbot<\/a><\/li>\n\n\n\n
- TrojanSpy:Win32\/Qakbot<\/a><\/li>\n\n\n\n
- Behavior:Win32\/Qakbot<\/a><\/li>\n<\/ul>\n\n\n\n
Black Basta threat components are detected as the following:<\/p>\n\n\n\n
\n
- Behavior:Win32\/Basta<\/a><\/li>\n\n\n\n
- Ransom:Win32\/Basta<\/a><\/li>\n\n\n\n
- Trojan:Win32\/Basta<\/a><\/li>\n<\/ul>\n\n\n\n
Microsoft Defender Antivirus detects Beacon running on a victim process as the following:<\/p>\n\n\n\n
\n
- Behavior:Win32\/CobaltStrike<\/a><\/li>\n\n\n\n
- Backdoor:Win64\/CobaltStrike<\/a><\/li>\n\n\n\n
- HackTool:Win64\/CobaltStrike<\/a><\/li>\n<\/ul>\n\n\n\n
Additional Cobalt Strike components are detected as the following:<\/p>\n\n\n\n
\n
- TrojanDropper:PowerShell\/Cobacis<\/a><\/li>\n\n\n\n
- Trojan:Win64\/TurtleLoader.CS<\/a><\/li>\n\n\n\n
- Exploit:Win32\/ShellCode.BN<\/a><\/li>\n<\/ul>\n\n\n\n
SystemBC components are detected as:<\/p>\n\n\n\n
\n
- Behavior:Win32\/SystemBC<\/a><\/li>\n\n\n\n
- Trojan: Win32\/SystemBC<\/a><\/li>\n<\/ul>\n\n\n\n
Microsoft Defender for Endpoint<\/h3>\n\n\n\n
Alerts with the following title in the security center can indicate threat activity on your network:<\/p>\n\n\n\n
\n
- Suspicious activity using Quick Assist<\/li>\n<\/ul>\n\n\n\n
The following alerts might also indicate activity related to this threat. Note, however, that these alerts can also be triggered by unrelated threat activity.<\/p>\n\n\n\n
\n
- Suspicious curl behavior<\/li>\n\n\n\n
- Suspicious bitsadmin activity<\/li>\n\n\n\n
- Suspicious file creation by BITSAdmin tool<\/li>\n\n\n\n
- A file or network connection related to a ransomware-linked emerging threat activity group detected \u2014This alert captures Storm-1811 activity<\/em><\/li>\n\n\n\n
- Ransomware-linked emerging threat activity group Storm-0303 detected \u2014 This alert captures some Qakbot distributor activity<\/em><\/li>\n\n\n\n
- Possible Qakbot activity<\/li>\n\n\n\n
- Possible NetSupport Manager activity<\/li>\n\n\n\n
- Possibly malicious use of proxy or tunneling tool<\/li>\n\n\n\n
- Suspicious usage of remote management software<\/li>\n\n\n\n
- Ongoing hands-on-keyboard attacker activity detected (Cobalt Strike)<\/li>\n\n\n\n
- Human-operated attack using Cobalt Strike<\/li>\n\n\n\n
- Human-operated attack implant tool detected<\/li>\n\n\n\n
- Ransomware behavior detected in the file system<\/li>\n<\/ul>\n\n\n\n
Indicators of compromise<\/h2>\n\n\n\n
Domain names:<\/strong><\/p>\n\n\n\n
\n
- upd7a[.]com<\/li>\n\n\n\n
- upd7[.]com<\/li>\n\n\n\n
- upd9[.]com<\/li>\n\n\n\n
- upd5[.]pro<\/li>\n\n\n\n
- antispam3[.]com<\/li>\n\n\n\n
- antispam2[.]com<\/li>\n<\/ul>\n\n\n\n
SHA-256:<\/strong><\/p>\n\n\n\n
\n
- 71d50b74f81d27feefbc2bc0f631b0ed7fcdf88b1abbd6d104e66638993786f8<\/li>\n\n\n\n
- 0f9156f91c387e7781603ed716dcdc3f5342ece96e155115708b1662b0f9b4d0<\/li>\n\n\n\n
- 1ad05a4a849d7ed09e2efb38f5424523651baf3326b5f95e05f6726f564ccc30<\/li>\n\n\n\n
- 93058bd5fe5f046e298e1d3655274ae4c08f07a8b6876e61629ae4a0b510a2f7<\/li>\n\n\n\n
- 1cb1864314262e71de1565e198193877ef83e98823a7da81eb3d59894b5a4cfb<\/li>\n<\/ul>\n\n\n\n
ScreenConnect relay:<\/strong><\/p>\n\n\n\n
\n
- instance-olqdnn-relay.screenconnect[.]com<\/li>\n<\/ul>\n\n\n\n
NetSupport C2:<\/strong><\/p>\n\n\n\n
\n
- greekpool[.]com<\/li>\n<\/ul>\n\n\n\n
Cobalt Strike Beacon C2:<\/strong><\/p>\n\n\n\n
\n
- zziveastnews[.]com<\/li>\n\n\n\n
- realsepnews[.]com<\/li>\n<\/ul>\n\n\n\n
Advanced hunting <\/h2>\n\n\n\n
Microsoft Defender XDR<\/h3>\n\n\n\n
To locate possible malicious activity, run the following query in the Microsoft Defender portal:<\/p>\n\n\n\n
This query looks for possible email bombing activity:<\/p>\n\n\n
\nEmailEvents\n| where EmailDirection == "Inbound"\n| make-series Emailcount = count()\n on Timestamp step 1h by RecipientObjectId\n| extend (Anomalies, AnomalyScore, ExpectedEmails) = series_decompose_anomalies(Emailcount)\n| mv-expand Emailcount, Anomalies, AnomalyScore, ExpectedEmails to typeof(double), Timestamp\n| where Anomalies != 0\n| where AnomalyScore >= 10\n<\/pre><\/div>\n\n\nThis query looks for possible Teams phishing activity.<\/p>\n\n\n
\nlet suspiciousUpns = DeviceProcessEvents\n| where DeviceId == "alertedMachine"\n| where isnotempty(InitiatingProcessAccountUpn)\n| project InitiatingProcessAccountUpn;\nCloudAppEvents\n| where Application == "Microsoft Teams"\n| where ActionType == "ChatCreated"\n| where isempty(AccountObjectId)\n| where RawEventData.ParticipantInfo.HasForeignTenantUsers == true\n| where RawEventData.CommunicationType == "OneonOne"\n| where RawEventData.ParticipantInfo.HasGuestUsers == false\n| where RawEventData.ParticipantInfo.HasOtherGuestUsers == false\n| where RawEventData.Members[0].DisplayName in ("Microsoft Security", "Help Desk", "Help Desk Team", "Help Desk IT", "Microsoft Security", "office")\n| where AccountId has "@"\n| extend TargetUPN = tolower(tostring(RawEventData.Members[1].UPN))\n| where TargetUPN in (suspiciousUpns)\n\n<\/pre><\/div>\n\n\nMicrosoft Sentinel<\/strong><\/h3>\n\n\n\n
Microsoft Sentinel customers can use the TI Mapping analytics (a series of analytics all prefixed with \u2018TI map\u2019) to automatically match the malicious domain indicators mentioned in this blog post with data in their workspace. If the TI Map analytics are not currently deployed, customers can install the Threat Intelligence solution from the Microsoft Sentinel Content Hub<\/a> to have the analytics rule deployed in their Sentinel workspace.<\/p>\n\n\n\n
Microsoft Sentinel also has a range of hunting queries available in Sentinel GitHub repo or as part of Sentinel solutions that customers can use to detect the activity detailed in this blog in addition to Microsoft Defender detections. These hunting queries include the following:<\/p>\n\n\n\n
Qakbot:<\/p>\n\n\n\n
\n
- Qakbot hunting queries<\/a><\/a><\/a><\/li>\n<\/ul>\n\n\n\n
Cobalt Strike:<\/p>\n\n\n\n
\n
- Cobalt Strike DNS Beaconing<\/a><\/li>\n\n\n\n
- Potential ransomware activity related to Cobalt Strike<\/a><\/li>\n\n\n\n
- Suspicious named pipes<\/a><\/li>\n\n\n\n
- Cobalt Strike Invocation using WMI<\/a><\/a><\/a><\/li>\n<\/ul>\n\n\n\n
References<\/h2>\n\n\n\n
\n
- Defense and Mitigations from E-mail Bombing<\/a>. U.S. Department of Health and Human Services, Health Sector Cybersecurity Coordination Center<\/li>\n<\/ul>\n\n\n\n
Learn more<\/h2>\n\n\n\n
For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog: https:\/\/aka.ms\/threatintelblog<\/a>.<\/p>\n\n\n\n
To get notified about new publications and to join discussions on social media, follow us on LinkedIn at https:\/\/www.linkedin.com\/showcase\/microsoft-threat-intelligence<\/a>, and on X (formerly Twitter) at https:\/\/twitter.com\/MsftSecIntel<\/a>.<\/p>\n\n\n\n
To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast: https:\/\/thecyberwire.com\/podcasts\/microsoft-threat-intelligence<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"
Microsoft Threat Intelligence has observed Storm-1811 misusing the client management tool Quick Assist to target users in social engineering attacks that lead to malware like Qakbot followed by Black Basta ransomware deployment. <\/p>\n","protected":false},"author":68,"featured_media":134334,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3663],"topic":[3687],"products":[3690,3694,3698],"threat-intelligence":[3727,3730,3735,3736,3738],"tags":[],"coauthors":[3380],"yoast_head":"\n
Threat actors misusing Quick Assist in social engineering attacks leading to ransomware | Microsoft Security Blog<\/title>\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\t\n\n\n\n\n\t\n\t\n\t\n