Arctic Wolf

Arctic Wolf Customer,

This bulletin is being sent to alert organizations to what appears to be an active campaign leveraging trusted Microsoft utilities, Teams and Quick Assist, to gain access into corporate networks. Both intrusions analyzed by Arctic Wolf appear opportunistic, which is consistent with financially motivated access brokers who monetize footholds through resale to ransomware affiliates or via follow‑on operations. There is no evidence of sector‑specific targeting or strategic regional focus, meaning any organization could be targeted.

Details

Arctic Wolf observed two independent intrusions—on 2026‑06‑23 and 2026‑07‑06—each beginning with external Microsoft Teams social engineering that convinced users to start a Quick Assist remote assistance session and grant control of their Windows workstations. Both environments were domain‑joined enterprise systems with standard productivity tooling and endpoint security controls in place, underscoring that this tradecraft is effective even in relatively mature environments.

In the June 23 incident (Intrusion 1), the actor compromised a U.S. food & beverage customer. Within minutes of obtaining Quick Assist access, they executed PowerShell reconnaissance, exfiltrated host details to attacker infrastructure, and then delivered three payload “waves”: an Adobe‑themed MSI dropping a Rust‑based reverse‑SOCKS proxy (accc.exe), a standalone binary (feature.exe), and a second MSI dropping vortexcore.exe with Startup folder persistence.

In the July 6 incident (Intrusion 2), an international manufacturing customer had multiple users in Germany targeted. The actor repeated the same high‑level playbook across three users in sequence: Teams helpdesk pretext plus email bombing, Quick Assist compromise, download of systemcheck.zip, and execution of a fake Windows security update flow that culminated in deployment of Xray-core as ChromeUpdate.exe—a VLESS+Reality tunneling implant with persistence via a deceptive GoogleChromeUpdateCore Run key or hidden scheduled task.

Abuse of Trusted Microsoft Workflows and Cloud Infrastructure

In both cases the threat actor avoided custom first‑stage malware in favor of trusted, Microsoft-branded workflows. Initial contact and social engineering were conducted over Microsoft Teams, remote access was obtained via Quick Assist (signed, built‑in Windows component), and payload staging leveraged Microsoft SharePoint and DevTunnels. Additional payload hosting used GitHub, Dropbox, and Cloudflare‑fronted domains to further blend into organization‑typical traffic.

    This “ live off the SaaS land” strategy is significant because it sidesteps email security controls and URL‑reputation‑only defenses. For example, in Intrusion 1 all three PowerShell loaders (val.ps1 variants) were hosted on an attacker‑controlled SharePoint tenant, and payload MSIs and executables were fetched from Cloudflare‑fronted .online domains with short registration histories.

    Because Quick Assist sessions are often under‑logged by default and the surrounding traffic appears legitimate, organizations that lack detailed endpoint telemetry (EDR/Sysmon) and strong SaaS observability are particularly vulnerable. This raises the importance of remote‑support governance and behavioral analytics that can correlate human‑assistance workflows with unusual follow‑on activity.

    Key Takeaways from Both Campaigns

    Across both intrusions, several patterns emerge:

    • Social engineering + Quick Assist is the primary initial‑access vector, not a software exploit.
    • PowerShell is the central execution engine, driving reconnaissance, payload download, and installer orchestration.
    • Multi‑payload redundancy is used to race EDR controls and ensure at least one implant successfully persists.
    • Persistence is achieved via Run keys, Startup folder shortcuts, and scheduled tasks, themed as benign software updaters.
    • Final implants are encrypted tunneling proxies, indicating an access‑enablement objective rather than immediate ransomware or data destruction. There was also no lateral movement observed.

    From a defender’s perspective, this means no single IOC is durable: domains, IPs, and hashes can and will rotate. The resilient detection axis is the sequence of behaviors—Teams contact from external identities, Quick Assist invocation, archive/script execution, new persistence creation, and unusual encrypted outbound connections from user workstations.

    Why This Matters Now

    The convergence of tradecraft across two seemingly unrelated teams — different sectors, geographies, and tunneling tool families — suggests this could represent either a shared “playbook” circulating in underground communities or the same operator evolving their tooling between operations.

    In practical terms, this means:

    • Defenders should not over‑focus on any single malware family but instead anchor detection on abuse of remote assistance + behavioral persistence + tunneling.
    • Organizations that permit external Teams contacts but lack user training and conditional access policies face rising risk of similar compromises.
    • The presence of encrypted tunnels and locally harvested credentials significantly increases the potential impact, even in cases where no lateral movement or exfiltration has yet been observed.

    Given the continuing adoption of Microsoft Teams and the default availability of Quick Assist in modern Windows builds, this attack surface is both widespread and likely to remain attractive to adversaries.

    Arctic Wolf Response

    Arctic Wolf ® Threat Research, Detection Engineering, and Managed Detection and Response (MDR) teams have already incorporated the observed TTPs and IOCs into stateful and behavior‑based detections, including rules that:

    • Correlate Quick Assist execution with archive/script downloads and subsequent persistence changes.
    • Flag external Teams chats from untrusted domains that precede Quick Assist sessions and unusual PowerShell activity.
    • Detect suspicious Run key and scheduled task names.

    Operational and Business Impacts

    Even in the absence of confirmed lateral movement or data exfiltration, the observed tradecraft creates several high‑impact conditions:

    • Account compromise and impersonation: Users willingly grant Quick Assist control, allowing actors to perform any action available to the logged‑in account, including credential changes, MFA registration manipulations, and local configuration tampering.
    • Persistent covert access: Run keys, Startup shortcuts, and SYSTEM scheduled tasks create auto‑start tunnels that may survive reboots and normal IT operations.
    • Defense evasion: Masquerading as Adobe or Chrome updaters and leveraging trusted cloud infrastructure make these implants far harder to catch with signature‑only approaches or allow‑lists.
    • Regulatory and reputational exposure: If tunneled access is used to exfiltrate sensitive customer or IP data, organizations could face breach notification obligations, regulatory scrutiny, and reputational damage, even if no ransomware event occurs.

    Organizations that do not centrally manage remote‑support tooling, or that allow external Teams contact by default, face a particularly elevated risk of silent foothold establishment.

    Recent Trends and Broader Threat Landscape

    The observed tradecraft is not isolated; it reflects a broader and escalating threat landscape in which adversaries increasingly abuse trusted remote-support workflows, collaboration platforms, and cloud infrastructure to gain access while blending into normal enterprise activity.

    Since April 2024, Arctic Wolf and other vendors have tracked Black Basta ransomware affiliates abusing Windows Quick Assist (and increasingly Microsoft Teams) in vishing‑enabled social engineering campaigns to gain interactive access, deploy Qakbot or RMM tools and ultimately, ransomware.

    More broadly, Arctic Wolf has documented Quick Assist and other remote support tool abuse in multiple environments, often combined with email bombing and Teams impersonation to pressure users into accepting remote sessions. This places the two June–July 2026 intrusions squarely within a larger criminal ecosystem that favors legitimate remote‑support and RMM tooling as stealthy entry points.

    Key trends that increase the urgency of addressing this vector include:

    • Email bombing and vishing being operationalized in more campaigns to create “urgent” support scenarios that drive Quick Assist usage.
    • Expansion from phone calls to Microsoft Teams‑based impersonation, lowering friction and making it easier to reach a wide set of users in modern enterprises.
    • Increasing abuse of DevTunnels, cloud storage, and GitHub as payload hosts, making simple domain blocking less effective.
    • Despite Microsoft adding more on‑screen warnings and scam education prompts to Quick Assist in 2025, user behavior under pressure remains the weakest link.

    Taken together, these trends point to continuing and likely expanding abuse of remote-support channels in 2026–2027.

    Hardening and Prevention

    Remote Support Controls

    • Disable or remove Quick Assist wherever it is not explicitly required for business operations. This can be enforced via Group Policy, Intune, or application removal.
    • Where remote assistance is necessary, standardize on managed tools that provide logging

    Application Control and Script Governance

    • Deploy application whitelisting (e.g., Windows Defender Application Control, AppLocker) to:
    • Block or prompt on unsigned binaries executing from user‑writable paths.
    • Restrict PowerShell usage to signed scripts and administrative contexts.
    • Monitor for and block unusual processes using updater‑themed names (ChromeUpdate.exe, AdobeCreativeCloud, etc.) from non‑standard directories.

    Identity and Access Management

    • Enforce MFA for all users, and mandate phishing‑resistant factors (FIDO2/WebAuthn) for privileged or high‑risk roles where feasible.
    • Implement conditional access and anomaly detection (e.g., impossible travel, unusual ASNs), especially for logons following Quick Assist events.

    Network and Egress Controls

    • Restrict or tightly monitor access from user endpoints to newly registered, rarely seen, or untrusted TLD domains.
    • Consider egress allow‑listing for sensitive segments, ensuring only approved services (e.g., corporate SaaS, update servers) are reachable.

    User Awareness and Process

    • Update security‑awareness training to explicitly cover:
      • Teams‑based impersonation and remote support scams.
      • The principle that IT will never request a Quick Assist session via unsolicited external chats or calls.
    • Define and communicate clear internal procedures for verifying remote-support requests (e.g., via corporate ticketing system or official directory look‑up) before any session is allowed.
    • Managed Security Awareness | Arctic Wolf ends human risk by delivering 100%-relevant microlearning content that your employees will actually pay attention to.

    Overall Assessment and Strategic Takeaways

    The two Quick Assist–enabled intrusions analyzed in this bulletin demonstrate a mature, repeatable intrusion playbook that:

    • Starts with people, not exploits—leveraging Teams‑based impersonation and phone/email pressure to co‑opt users into launching Quick Assist.
    • Deploys multi‑stage, cloud‑hosted payloads via PowerShell and trusted infrastructure.
    • Establishes encrypted tunnels and durable persistence designed for follow‑on exploitation rather than immediate smash‑and‑grab activity.

    The strongest conclusion is that organizations must treat built‑in remote support capabilities as high‑risk, high‑impact attack surfaces and design controls accordingly. The most robust defense is behavioral detection and strict governance over when, how, and by whom remote support tools may be used—not reliance on blocking a particular malware strain or IP address.

    References


      Follow us:

      .