What happened
Researchers identified a repeatable social‑engineering campaign that sends malicious Microsoft Teams external chat links to targets. Once a victim accepts the invitation, the attackers execute a rapid “bombing” sequence that drops a malware payload—often a ransomware dropper—within roughly 15 minutes. The pattern matches tactics used by the Black Basta ransomware group, suggesting a possible affiliation. The campaign targets organizations that allow external Teams collaboration without additional verification, and it remains active with new invitations being sent daily.
Why it matters for trust and compliance
- The episode demonstrates how weak guest‑access policies and insufficient user awareness can undermine control objectives around identity management and secure collaboration, making continuous monitoring and training essential for audit readiness.
- Map guest‑access controls to identity‑and‑access control objectives across frameworks.
- Collect evidence of external Teams joins and rapid‑follow‑up activity for audit trails.
Who is affected
Enterprises using Microsoft Teams for external collaboration
Recommended actions
- Enforce MFA and conditional‑access policies for all external Teams guests.
- Add Teams‑chat phishing scenarios to security‑awareness training programs.
- Enable logging of external guest joins and set alerts for rapid‑follow‑up messages.
- Require admin approval for any new external Teams invitation.