Full Report
Unit 42 details how attackers exploit enterprise collaboration tools for identity phishing and credential theft. Discover key defense strategies. The post Identity Abuse Through Trusted Communication Channels appeared first on Unit 42.
Analysis Summary
# Tool/Technique: Trusted Communication Channel Exploitation (Identity Phishing)
## Overview
This technique involves leveraging trusted enterprise collaboration platforms (such as Microsoft Teams, Slack, and Zoom) to conduct identity phishing and credential theft. Attackers bypass traditional email security perimeters by using compromised accounts or external access features to send malicious links and files within internal chat environments where users have a higher baseline of trust.
## Technical Details
- **Type:** Technique / Social Engineering Pattern
- **Platform:** Windows, macOS, Linux, iOS, Android (Cross-platform collaboration suites)
- **Capabilities:** Credential harvesting, MFA bypass (via Adversary-in-the-Middle), malware distribution, and lateral movement.
- **First Seen:** Increased prevalence noted starting in 2023-2024.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.002 - Phishing: Spearphishing Link
- T1566.003 - Phishing: Spearphishing Attachment
- T1078 - Valid Accounts
- **TA0006 - Credential Access**
- T1557 - Adversary-in-the-Middle
- T1539 - Steal Web Session Cookie
- **TA0008 - Lateral Movement**
- T1213.002 - Information Repositories: Sharepoint/Teams
## Functionality
### Core Capabilities
- **Internal Impersonation:** Using compromised internal accounts to message colleagues, exploiting the "implicit trust" of the platform.
- **External Tenant Access:** Using "External Access" features in Microsoft Teams to message users in target organizations from attacker-controlled tenants.
- **Credential Harvesting:** Sending links to sophisticated phishing landing pages designed to look like corporate SSO logins.
### Advanced Features
- **AitM (Adversary-in-the-Middle) Frameworks:** Integration with tools like EvilProxy or Mamba2FA to intercept MFA tokens and session cookies in real-time.
- **Darkgate/Pikabot Distribution:** Using chat attachments (VBS, LNK, or ZIP files) to deploy loaders that bypass email gateway scanners.
- **QR Code Phishing (Quishing):** Embedding malicious URLs in QR codes sent via chat to move the session to a mobile device, often lacking enterprise security controls.
## Indicators of Compromise
- **File Names:** `Invoice_XXXX.zip`, `Meeting_Agenda.lnk`, `Employee_Benefits.pdf.exe`
- **Network Indicators:**
- `login.microsoftonline.com-us[.]web[.]app` (Defanged)
- `teams-us-session[.]com` (Defanged)
- `auth-verification-service[.]net` (Defanged)
- **Behavioral Indicators:**
- Sudden influx of messages from external tenants or "Unknown Users."
- Unusual login patterns (impossible travel) following a user clicking a chat link.
- Large volume of file shares from a single user account to multiple departments.
## Associated Threat Actors
- **Storm-0324** (Known for using Teams to distribute JSSLoader)
- **APT29 / Midnight Blizzard** (Utilizing compromised tenants to target government/NGOs via Teams)
- **Scattered Spider** (Extensive use of social engineering and identity bypass)
## Detection Methods
- **Behavioral detection:** Monitoring for anomalous "External Access" chat requests and spikes in API calls to collaboration platforms.
- **Log Analysis:** Reviewing Microsoft Entra ID (Azure AD) logs for suspicious User Agent strings or non-compliant device logins following a chat interaction.
- **Security Posture Management:** Identifying accounts with excessive permissions that are active in "Public" or "Global" chat channels.
## Mitigation Strategies
- **Technical Hardening:** Restrict Microsoft Teams External Access to only "Allowed Domains" rather than "Open."
- **Authentication:** Enforce Phishing-Resistant MFA (FIDO2/WebAuthn) to prevent AitM session hijacking.
- **Policy:** Implement "Safe Links" and "Safe Attachments" for Microsoft Teams via Defender for Office 365.
- **Education:** Train employees to verify out-of-band identity when receiving unexpected files or links, even from known colleagues.
## Related Tools/Techniques
- **EvilProxy:** An AitM phishing toolkit.
- **TeamsPhisher:** A Python-based tool that automates the delivery of phishing attachments to Teams users.
- **Microsoft Graph API Exploitation:** Used by attackers to automate the sending of messages across an organization once an account is compromised.