Evolving Malware Attacks: A Microsoft Teams’ Vulnerability

Security researchers at Jumpsec have discovered a new technique that enables threat actors to deliver malware to organizations using Microsoft Teams. By exploiting the default configuration of Microsoft Teams, threat actors can bypass security measures, potentially compromise sensitive data and systems, and send a malicious payload directly to a target's inbox. This technique allows them to bypass client-side protections and present the malware as a file within the Microsoft Teams interface.

Attack Details

• Attack Type: Malware Delivery

• Targeted Platform: Microsoft Teams

• Methods: Exploiting default configuration, impersonation, phishing, misconfiguration

• Potential Impact: Compromised systems, unauthorized access, data theft

Description of the Attack

Threat actors manipulate the internal and external recipient IDs in the POST request of a message to trick the system into treating an external user as an internal one. This manipulation enables the delivery of a malicious payload. The payload is hosted on a SharePoint domain and appears as a file within the target's Microsoft Teams inbox, increasing the likelihood of users downloading and executing the malware. Jumpsec’s researchers promptly reported their findings to Microsoft, emphasizing the significance of the vulnerability. However, Microsoft's response indicates that the issue "does not meet the bar for immediate servicing," suggesting a lack of urgency in addressing the vulnerability.

Recommended Mitigation

To mitigate the risks associated with this malware delivery technique via Microsoft Teams, organizations are advised to take the following actions:

• Disable External Access: If regular communication with external tenants is not required, consider disabling the external access feature in the Microsoft Teams Admin Centre. This limits the potential for exploitation through external accounts.

• Define Domain Allow-list: Maintain external communication channels. It is recommended to define specific domains in an allow-list. This reduces the risk of unauthorized access and malware delivery. 

• Regular Software Updates: Ensure that Microsoft Teams and all associated software components are regularly updated and patched to address any known vulnerabilities.

In conclusion, this threat report highlights a significant malware delivery technique observed in Microsoft Teams. By exploiting the default configuration, threat actors can deliver malware payloads, potentially compromising the organization’s systems, and data. The lack of an immediate response from Microsoft underscores the importance of implementing the recommended mitigation measures to protect against this threat. Organizations should remain vigilant and continuously enhance their security posture to defend against evolving malware delivery techniques.