Microsoft Teams Hit by ‘FakeUpdates’ Malware Using Cobalt Strike; Here’s How to Prevent It
Microsoft warned its users about recent “FakeUpdates” campaigns targeting various types of companies, particularly the education sector that uses Teams videoconferencing app.
According to a Bleeping Computer as shared by Threat Post, the tech giant warned its customers about the security threat using fake Microsoft Teams update ads as backdoors to infect networks with malware. They use Cobalt Strike in this campaign, which targets the K-12 education and other companies, which are currently dependent on videoconferencing apps such as Microsoft Teams amid the coronavirus pandemic.
(Photo : Microsoft)
Microsoft Teams Is Under Attack by ‘FakeUpdates’ Malware Using Cobalt Strike
Microsoft Teams: ‘FakeUpdates’ Malware Uses Cobalt Strike
According to a report, cyber attackers use Cobalt Strike to infect company networks outside the infection point.
Cobalt Strike is being used by threat actors to spread ransomware and other kinds of malware. It is a commodity attack-simulation tool, which was used in exploiting the privilege-elevation flaw Zerologon that allows attackers to gain access to the domain controller and fully compromise Active Directory identity services.
The Microsoft advisory stated that attackers in the recent FakeUpdates campaign used search-engine ads to promote Teams software top results into a domain that they can use and control for infamous activity. Then, if victims would click the link, it would download a payload and execute a PowerShell script that loads malicious content.
Cybercriminals use Cobalt Strike as payload, so threat actors can laterally move across the network beyond the initial infection system. It also installs a valid Microsoft Teams app on the system, so it seems legitimate and prevents victims from noticing the attack.
(Photo : Microsoft)
‘FakeUpdates’ Malware Uses Cobalt Strike
The advisory also stated that the campaign dispenses malware, which include the infostealer Predator the Thief, which steals sensitive data including account credentials, payment data, and browsers. The tech giant also noticed the latest campaigns spreading ZLoader and Bladabindi (NJRat) backdoor.
In…
