Cybersecurity researchers at BlueVoyant have uncovered a sophisticated attack campaign using social engineering to breach enterprise networks.
Attackers bombard employees with spam emails and impersonate IT support on Microsoft Teams to offer help. Under the guise of fixing the issue, threat actors trick victims into granting remote access via Windows Quick Assist.
Once inside, they deploy a newly discovered malware dubbed A0Backdoor. Active since August 2025, this campaign shares tactics with the threat group Blitz Brigantine (Storm-1811).
This financially motivated group is frequently associated with Black Basta ransomware attacks, heavily targeting financial and healthcare organizations.
The attack begins with a flood of spam emails designed to overwhelm the target. Shortly after, attackers reach out through Microsoft Teams, posing as IT personnel responding to the email anomaly.
They convince the employee to open Windows Quick Assist, a built-in remote desktop tool. By willingly handing over control, the victim unknowingly bypasses traditional defenses. Once access is secured, attackers deploy malicious software to establish a foothold.
To make their tools appear legitimate, threat actors use digitally signed installation packages hosted on personal Microsoft cloud storage accounts. Because these files are delivered via temporary links, retroactive analysis becomes incredibly difficult.
Malware Deployment and Evasion
Once executed, attackers use DLL sideloading to load malicious code stealthily. Installers place files masquerading as legitimate Microsoft Teams and CrossDeviceService components into the user’s hidden application folders.
Among these is a malicious version of a Windows component signed with a deceptive certificate. This acts as a loader, unpacking and executing the next attack stage while hiding from security software.
Digital signatures rotate frequently, forcing attackers to refresh their tools to maintain the illusion of trust constantly.
The A0Backdoor and Covert Communication
After decrypting itself, the loader unleashes A0Backdoor into system memory. This stealthy backdoor immediately scans the computer, collecting details such as the computer name to uniquely identify the device.
It also copies itself into a new memory location to obscure its presence from antivirus scanners. Instead of reaching out directly to attacker servers, which would trigger alerts, A0Backdoor uses DNS tunneling.
| Indicator Type | Indicator / Value | Description |
|---|---|---|
| SHA-256 | 0c99481dcacda99014e1eeef2e12de3db44b5db9879ce33204d3c65469e969ff | Malicious Update.msi package containing backdoor payload . |
| File Path | C:\Users\<User>\AppData\Local\Microsoft\CrossDevice Share\25017.203.3370 | Drop location for malicious CrossDevice Service packages |
By repurposing old, expired domain names rather than creating new ones, bluevoyant attackers further reduce suspicion.
This helps custom servers bypass security filters that block newly registered domains. This combination of social engineering, memory-based execution, and covert communication highlights a significant shift in how cybercriminals bypass enterprise security controls.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
