External Teams Chats Anchor 15-Minute Malware Delivery
An ongoing campaign — possibly tied to Black Basta — pairs email-bombing with external Microsoft Teams chat requests to deliver malware within 15 minutes, exploiting a trust gap that email gateways alone cannot close.
Summary written by editorial AI · Source link below
Main bombing sis getting a new look with a wide-scale, ongoing social engineering campaign that might be tied to the Black Basta ransomware gang.
Editorial Analysis
European enterprises permitting external Teams federation face a rapid social-engineering path that sidesteps email security stacks entirely, with potential ransomware deployment as the end goal.
Disable or tightly control external Teams chat federation, deploy alerting for email-bombing patterns, and update incident-response playbooks to cover combined email-plus-Teams social engineering.
A ransomware-linked campaign uses Microsoft Teams external chat to deliver malware in under 15 minutes — restricting external Teams access is an immediate risk-reduction measure.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at Dark Reading in a new tab.
More from the Threat Intel Desk
- Hackers pull off $133 million French bank heist via service provider2d
- Fake security tools on GitHub push backdoors and infostealers3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 45 (2026)3d
- CEO-spoofing scammers used AI to help steal more than $100 million, feds say3d
- Chainalysis says breach exposed credentials for all customers3d