Attackers persuade employees to accept a remote-control request during screen sharing or to open Quick Assist and provide its access code. Once inside, they use legitimate remote management and support tools to control the device.
They then run PowerShell to download a malicious MSI package from cloud storage and install it silently with Windows Installer. This is social engineering, not a Teams software flaw.
The attacker relies on users overriding visible external-contact warnings and trusting a familiar support workflow.
The MSI stages a portable Node.js runtime and an encrypted JavaScript implant under the user’s LocalAppData folder.
If Node.js is absent, the loader downloads the legitimate runtime from the official Node.js distribution. Hidden bootstrap code launched through PowerShell, cmd.exe, or WScript decrypts the implant and runs it with node.exe.
The use of a signed runtime, sometimes renamed, helps the activity blend with normal operations. The malware also uses harmless-looking names, nonstandard file extensions, and silent installation.
This lets adversaries avoid easy detections focused only on unknown executables or obvious script files. Every component remains in a user-writable location for convenience.
Node.js Runtime Backdoor Abuse
To survive reboots, observed installers create an EdgeUpdate entry in the current user’s Run key or Startup folder. At sign-in, the entry starts WScript or Node.js and reloads the hidden JavaScript backdoor.
The implant calls its command-and-control server through randomized HTTPS long-polling requests. Responses are treated as JavaScript tasks, giving an outside operator access to the file system, processes, environment variables, and Node.js modules.
Microsoft observed commands collecting system information, disk details, antivirus products, display adapters, and virtualization clues.
Operators also captured screenshots at intervals, resized them, encoded them, and sent them out. Dormant code could query an Ethereum contract.
That contract could provide a replacement C2 URL, although Microsoft said the recovered builds used a hard-coded fallback server. After validating access, the actor expands into Active Directory.
Native commands and ADSI queries enumerate domain accounts, users, servers, and descriptive fields that may reveal privileged roles or operational context.
The backdoor can also launch additional DLL payloads through rundll32.exe, a trusted Windows binary. Most concerning, operators use WinRM over TCP port 5985 to reach domain-joined systems.
Targets included file servers, database servers, application servers, domain controllers, and certificate authorities.
This credential-backed movement signals a hands-on-keyboard operation that could lead to data theft, extortion, or ransomware, Microsoft said.
Indicators of Compromise
| Indicator type | SHA-256 / Pattern | Description |
|---|---|---|
| Malicious MSI | 4cfdcae6dd1d6d98b870c8f0654d504f2bf10479a117dc297de789c249dc389d | Malicious MSI loader package used in silent installation |
| Malicious MSI | a4d145a6347e47d40b3ca48af5c6dba01bf019d0110e31a44bb70fc77d1d1676 | Malicious MSI loader pack |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
