Loading story…
Black Basta affiliates used a multi-stage social-engineering campaign to breach corporate networks by impersonating IT support staff in Microsoft Teams and persuading employees to grant remote access through Windows Quick Assist and AnyDesk. Researchers said the attacks often began with email bombing to overwhelm targets, followed by Teams chats or calls from attacker-controlled external Entra ID tenants using names such as "Help Desk" or "support." In earlier incidents, the group similarly abused Quick Assist after contacting victims by phone, showing a consistent pattern of using legitimate remote-support tools to gain initial access.
After access was established, the attackers deployed additional tooling including ScreenConnect, NetSupport Manager, Cobalt Strike, and SystemBC-linked payloads, while also using credential-theft and lateral-movement activity such as accessing LSASS, scanning internal hosts, and running Impacket secretsdump.py. ReliaQuest also observed malicious QR-code lures tied to domains such as qr-s1[.]com through qr-s4[.]com, and a VBS-based infection chain that contacted 179.60.149[.]194 to retrieve follow-on payloads. The activity was attributed to Black Basta with high confidence, with reporting indicating infrastructure and Teams activity linked to Russia, and defenders were urged to restrict external Teams communications, limit trusted domains, and improve Teams, email, and remote-access monitoring.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
In late October 2024, Black Basta targeted users with mass email spam and then added them to one-on-one Microsoft Teams chats from external accounts using deceptive tenant names and 'Help Desk' display names.
In October 2024, ReliaQuest investigated an Impacket-related alert and identified a broader Black Basta intrusion chain involving AnyDesk, fake anti-spam binaries, credential theft, internal scanning, Cobalt Strike, and secretsdump.py before containment.
In October 2024, ReliaQuest observed Black Basta evolving from phone-based impersonation to Microsoft Teams messages from attacker-controlled Entra ID tenants posing as help-desk or support staff.
In May 2024, Rapid7 and ReliaQuest released advisories about a Black Basta social-engineering campaign that used email flooding, fake IT-help-desk contact, and remote-access tools.
After the Conti cybercrime syndicate shut down in June 2022, one resulting faction was believed to be Black Basta.
Black Basta was active by April 2022, marking the start of the ransomware operation later tied to the social-engineering campaigns described in the references.
In one late-November 2024 incident, attackers used Teams communications and a follow-up call to trick a user into downloading filter_update.vbs, which attempted domain enumeration, contacted 179.60.149[.]194, and tried to download additional payloads before the activity was contained.
In late November 2024, ReliaQuest responded to several Black Basta-related incidents and identified new tactics including Teams messages and calls following mass email bombing.
3 references tracked. Mallory keeps watching after this page renders.
google.com
Open sourcereliaquest.com
Open sourcegoogle.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Suspected former **Black Basta** affiliates have launched a fast-scaling social-engineering campaign against dozens of organizations, targeting more than 100 employees to gain network access for **data theft, ransomware deployment, and extortion**. According to ReliaQuest, the operators use mass email bombing to overwhelm victims and then follow up through **Microsoft Teams** messages or phone calls while impersonating IT help desk staff. The activity has been linked to former Black Basta members or closely aligned actors because the tooling, targeting, and execution closely mirror the group’s historical playbook, even after Black Basta fragmented following the leak of its internal chats. The campaign has increasingly focused on senior leaders and other highly privileged personnel, with executive targeting rising from **59%** in January and February to **77%** in March. Attackers have persuaded victims to install remote monitoring and management tools such as **Supremo Remote Desktop** or to launch **Windows Quick Assist**, sometimes obtaining remote access within minutes before running malicious scripts. Manufacturing and professional services have been hit hardest, with finance, insurance, construction, and technology also affected, underscoring how the operators are moving faster and using more automation to scale intrusions and make early detection more difficult.
Jun 29, 2026
Microsoft and Sophos reported separate but closely aligned social-engineering campaigns in which attackers impersonated IT support staff over Microsoft Teams, phone calls, and related pretexts to trick employees into granting remote access through **Quick Assist** or other support tools. Microsoft attributed its activity to **Storm-1811**, which used vishing and email-bombing to gain access, steal credentials through **EvilProxy**, and deploy tools including **Qakbot**, **Cobalt Strike**, **ScreenConnect**, **NetSupport Manager**, **OpenSSH** tunneling, and **SystemBC** before rolling out **Black Basta** ransomware with **PsExec**. Microsoft said it suspended malicious Teams accounts and tenants involved in the impersonation activity and added stronger Quick Assist warnings and trust indicators.
Aug 14, 2026
A social-engineering campaign targeting employees at **financial and healthcare** organizations is abusing **Microsoft Teams** chats/calls to trick users into granting remote access via *Windows Quick Assist*, enabling deployment of a newly identified malware family dubbed **A0Backdoor**. The activity begins with **email bombing** (flooding inboxes with spam) followed by an attacker impersonating internal IT over Teams, offering help and then persuading the victim to start a Quick Assist session; the tradecraft overlaps with tactics previously attributed to **Blitz Brigantine / Storm-1811**, which Microsoft has linked to **Black Basta**-associated operations. Post-access, the actor deploys **digitally signed MSI installers** masquerading as Teams-related components and *CrossDeviceService* (associated with Windows *Phone Link*), sometimes delivered via **tokenized links** from Microsoft personal cloud storage to appear trustworthy and hinder collection. BlueVoyant reported the installers drop files into user `AppData` paths that mimic legitimate Microsoft locations and use **DLL sideloading** (e.g., a malicious `hostfxr.dll`) to execute an in-memory loader that decrypts shellcode, performs sandbox checks, and ultimately extracts and runs **A0Backdoor** (using **AES**-encrypted payloads and a **SHA-256**-derived key), with anti-analysis behavior including excessive thread creation intended to disrupt debugging.
Jun 29, 2026