Combatting the Black Basta Threat: Mitigating Risks from Microsoft Quick Assist and Teams Attacks
Share this article:
In the ever-evolving landscape of cyber threats, the Black Basta ransomware group has emerged as a particularly formidable adversary. Since April 2024, this group has been leveraging Microsoft’s Quick Assist and more recently, Microsoft Teams, to gain unauthorized access to target networks. This post explores the techniques employed by these cybercriminals, the risks they pose, and the measures you can take to protect your organization.
Understanding the Attack Strategy
Black Basta’s campaign involves a blend of social engineering and technical exploits to breach victim networks. Here’s a detailed examination of their approach:
1. Social Engineering Techniques: Vishing and Email Bombing
The attackers initiate their campaign through vishing (voice phishing) attacks. By impersonating IT or help desk personnel, they call the victim, often presenting an urgent need to resolve a supposed issue on their device. They convince the victim to install Microsoft Quick Assist, providing a security code and necessary permissions to remotely control their system. This tactic exploits the trust users place in IT support, making it a highly effective initial access vector.
In a parallel tactic, the attackers employ email bombing, inundating the victim’s inbox with spam from various subscription services. This overload creates a sense of urgency and confusion, making the victim more likely to accept unsolicited help from the purported IT support personnel.
2. Exploiting Microsoft Quick Assist
Once remote access is obtained through Quick Assist, the attackers execute a series of commands using cURL to download malicious payloads. These payloads typically include:
- Qakbot: Malware known for stealing data and delivering additional payloads.
- ScreenConnect: A remote desktop tool facilitating persistent access to compromised systems.
- NetSupport Manager: Provides remote control features, enabling long-term access.
- Cobalt Strike: A penetration testing tool that, when misused, can execute sophisticated attacks, including lateral movement and ransomware deployment.
These tools are not merely for initial access; they establish a stronghold and enable lateral movement within the network. The attackers use them to enumerate domains, discover network resources, and deploy Black Basta ransomware, which encrypts files and demands ransom payments.
Microsoft Teams as a New Vector
In a significant development, Black Basta affiliates have begun leveraging Microsoft Teams as part of their attack strategy. On June 12, 2024, it was revealed that these cybercriminals had been using Teams to communicate with potential victims, sending messages and making calls under the guise of IT support. This new attack vector exploits the widespread use of Microsoft Teams in enterprise environments, making it a particularly dangerous avenue for cyberattacks.
Using Microsoft Teams for Malicious Activities
The attackers exploit Teams to:
- Send Phishing Messages: By posing as IT staff, they trick users into clicking on malicious links or sharing sensitive information.
- Make Impersonated Calls: Using Teams’ calling feature, they directly engage with victims, furthering the social engineering effort.
The objective is to coerce users into compromising their credentials or installing remote access tools, thereby granting the attackers the access they need to infiltrate and control the target systems.
Defensive Measures: Best Practices and Recommendations
To counter these sophisticated attacks, organizations must adopt a multi-faceted defense strategy. Here are some critical recommendations:
1. Disable or Uninstall Unnecessary Remote Support Tools
If your organization does not utilize Microsoft Quick Assist or other remote support tools, consider disabling or uninstalling them. This measure prevents attackers from exploiting these tools for unauthorized access.
How to Disable Quick Assist: Block traffic to https://remoteassistance.support.services.microsoft.com. This endpoint is crucial for establishing Quick Assist sessions.
How to Uninstall Quick Assist:
Via PowerShell: Run Get-AppxPackage -Name MicrosoftCorporationII.QuickAssist | Remove-AppxPackage -AllUsers as an administrator.
Via Windows Settings: Navigate to Settings > Apps > Installed apps > Quick Assist, select the ellipsis (…), and choose Uninstall.
Additionally, implement policies to restrict the installation and use of remote support tools, ensuring only approved and secure tools are utilized within your environment.
2. Enhance Security Awareness Training
Social engineering remains a potent tool for threat actors. Comprehensive security awareness training helps users recognize and report suspicious activities. Training modules should include vishing scenarios to educate users on identifying tech support scams and other social engineering tactics.
3. Safeguard Against Microsoft Teams Attacks
Here are several best practices to mitigate risks associated with Teams:
Educate Users: Instruct Teams users to check for the ‘External’ tag on messages from outside the organization, avoid sharing sensitive information, and be cautious about approving sign-in requests via chat.
Implement Security Policies: Follow best practices for securing Teams. These include configuring privacy settings, monitoring user activities, and enforcing multi-factor authentication (MFA).
In-Depth Look at Detections and Responses
Multiple detections are necessary to identify the Tactics, Techniques, and Procedures (TTPs) used in these campaigns. These include detections for email bombing, remote access software, and various tools used for ingress. Additionally, agent-based detections are in place for relevant tools across several TTPs, including credential access, discovery, and reconnaissance, which have been associated with Black Basta activities.
- Email Bombing Detection
- Email bombing can overwhelm users and disrupt normal business operations. Detection mechanisms should identify patterns consistent with email bombing, enabling prompt response to mitigate the impact and prevent further exploitation.
- Remote Access Tool Detection
- Monitoring for the presence and use of remote access tools like Quick Assist, ScreenConnect, and NetSupport Manager is crucial. Detections should be designed to flag unusual usage patterns of these tools, allowing for rapid intervention.
- Credential Access and Reconnaissance
- Credential theft and reconnaissance are critical stages in the attack chain. Agent-based detections should monitor for suspicious activities indicative of these stages, such as unusual login attempts and network scanning, providing an additional layer of defense.
Recommendations for Strengthening Security
- Implement Multi-Factor Authentication (MFA)
- MFA adds an extra layer of security, making it significantly harder for attackers to gain access even if they obtain user credentials. Ensure MFA is enforced for all remote access tools and critical systems.
- Regularly Update and Patch Systems
- Keeping your systems and applications up to date with the latest patches reduces the risk of exploitation through known vulnerabilities. Implement a robust patch management strategy to ensure timely updates.
- Conduct Regular Security Audits
- Regular security audits help identify and address potential vulnerabilities within your organization’s IT infrastructure. Use the insights from these audits to improve your security posture continually.
- Monitor and Analyze Network Traffic
- Implement advanced network monitoring and analysis tools to detect anomalies and suspicious activities in real-time. This proactive approach allows for swift response to potential threats.
The Black Basta ransomware group’s latest campaign underscores the importance of robust cybersecurity measures. By understanding their tactics and implementing the recommended best practices, organizations can significantly reduce the risk of falling victim to these sophisticated attacks. Stay informed, stay prepared, and ensure your defenses are resilient against the evolving threat landscape.
Protecting yourself and your organization from tech service scams and other cyber threats requires more than just awareness; it requires comprehensive training. At Hackethic, we offer specialized cybersecurity awareness training designed to equip you and your team with the knowledge and skills needed to recognize and combat these threats effectively. Visit our training page to learn more about how we can help safeguard your digital assets and ensure your cybersecurity practices are up to date.