Microsoft Teams Hit by 'FakeUpdates' Malware Using Cobalt Strike; Here's How to Prevent It

Microsoft warned its users about recent "FakeUpdates" campaigns targeting various types of companies, particularly the education sector that uses Teams videoconferencing app.

According to a Bleeping Computer as shared by Threat Post, the tech giant warned its customers about the security threat using fake Microsoft Teams update ads as backdoors to infect networks with malware. They use Cobalt Strike in this campaign, which targets the K-12 education and other companies, which are currently dependent on videoconferencing apps such as Microsoft Teams amid the coronavirus pandemic.

Microsoft Teams: 'FakeUpdates' Malware Uses Cobalt Strike

According to a report, cyber attackers use Cobalt Strike to infect company networks outside the infection point.

Cobalt Strike is being used by threat actors to spread ransomware and other kinds of malware. It is a commodity attack-simulation tool, which was used in exploiting the privilege-elevation flaw Zerologon that allows attackers to gain access to the domain controller and fully compromise Active Directory identity services.

The Microsoft advisory stated that attackers in the recent FakeUpdates campaign used search-engine ads to promote Teams software top results into a domain that they can use and control for infamous activity. Then, if victims would click the link, it would download a payload and execute a PowerShell script that loads malicious content.

Cybercriminals use Cobalt Strike as payload, so threat actors can laterally move across the network beyond the initial infection system. It also installs a valid Microsoft Teams app on the system, so it seems legitimate and prevents victims from noticing the attack.

The advisory also stated that the campaign dispenses malware, which include the infostealer Predator the Thief, which steals sensitive data including account credentials, payment data, and browsers. The tech giant also noticed the latest campaigns spreading ZLoader and Bladabindi (NJRat) backdoor.

In addition, Microsoft also saw similar patterns of attacks but with slight variations in another six campaigns, which suggests the same threat actors launch broader attacks. Microsoft also warned attackers using the IP Logger URL shortening service to access their targets' systems.

What is malware?

A malware is malicious software that contaminates computer systems to exploit, damage, or disable computers or networks to takeover core system functions, steal, encrypt, or delete data, illegally monitor user activity, or initiate spamming or forced advertising. Some cybercriminals also launch ransomware attacks to hijack sensitive files and extort money from users or companies.

Malware is usually distributed through email attachments, infected apps or websites, or fake internet advertisements, which was used in the recent Microsoft FakeUpdates campaigns.

Microsoft Teams Malware Protection: How to prevent attacks

To prevent malware attacks, Microsoft recommends people to use web browsers that can block malicious sites. The company also advised users to create strong local admin passwords, which cannot be easily guessed.

Also, admin privileges should be limited only to essential users. Meanwhile, other service accounts with similar same permissions as an administrator should also be avoided to prevent domain-wide access.

Meanwhile, Microsoft advised companies to block any executable files from being downloaded on the computer. This can be easily done by installing anti-spyware or anti-virus software that scan files and automatically remove malware and files that do not meet set criteria to limit the extent of the attacks. Just make sure all security tools are updated and detected malware is removed immediately.

This is owned by Tech Times

Written by CJ Robles