Threat actors are using fake IT support requests on Microsoft Teams to trick employees into granting remote access through Quick Assist, then deploying a multi-stage reverse shell designed to blend into normal Windows activity.
Researchers Ofek Lahiani and Raz Rubin reported that the campaign begins with social engineering. Attackers contact targets through external Microsoft Teams chats while posing as IT technicians.
They convince victims that a technical problem requires remote support and instruct them to open Microsoft’s legitimate Quick Assist application.
Once the victim grants access, the attacker has hands-on control of the device. The operator downloads a malicious MSI installer from an attacker-controlled Amazon S3 bucket and runs it using msiexec.exe.
Observed installer names include SE15724BW.msi and KB5094126.msi. The MSI package does not rely only on a clearly malicious executable.
Instead, it drops a legitimate signed application, such as FileZilla, Altap Salamander, or Kodi, alongside a malicious DLL. This method makes the activity appear more trustworthy to users and some security controls.
Teams Scammers Deploy Backdoors
The signed program loads a malicious DLL from its own installation folder instead of loading the legitimate Windows version from System32. Known malicious DLL names include vcruntime140.dll, vcruntime140_1.dll, and zlib1.dll.
After being loaded, the malicious DLL creates an encrypted HTTPS connection to an AWS API Gateway endpoint. The use of execute-api.amazonaws.com infrastructure can help attackers disguise command-and-control traffic as ordinary cloud-service activity.
The loader then uses Windows Management Instrumentation, or WMI, to start a separate reverse shell component. This is important because it breaks the obvious process chain between the signed application and the final remote-access tool.
Defenders may see WmiPrvSE.exe create an unusual child process such as File Transfer.exe, Module Agent.exe, or SupportHost.exe.
The reverse shell agent listens locally on 127.0.0.1:9001. It does not directly communicate with the internet. Instead, the malicious DLL acts as a relay between the external AWS command-and-control server and the local listener.
This two-part design offers an evasion advantage. The signed application is the component making outbound network connections, while the reverse shell communicates only through localhost.
That can make it harder for security products to associate the interactive shell with suspicious external traffic. When the local connection is established, the shell agent starts a ConPTY pseudo-terminal connected to cmd.exe.
The attacker can then run commands interactively, similar to working directly on the victim’s computer. Observed post-compromise activity includes whoami, ipconfig /all, net user /dom, and dsregcmd /status.
These commands help attackers identify the logged-in user, network configuration, domain environment, and device identity status. Operators also enumerate cloud-synced document folders, potentially searching for valuable files, github said.
Persistence may be established through a Startup-folder shortcut named salamand.lnk, which relaunches the signed loader when the user logs in.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
