Dragos reports that ransomware operators are increasingly disrupting industrial production by targeting the business IT systems that support operations, even without touching industrial control systems. The report highlights real-world social engineering where attackers impersonate internal IT on Microsoft Teams to persuade employees to screen-share and install remote access tools, and also notes a separate FBI warning about fake on-site “IT technicians” plugging in USB drives.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: a Teams chat pops up, “Hi, this is IT Support. Start a screen-share so we can install our monitoring tool.” Ransomware groups are doing exactly this, posing as internal IT on Teams, then walking people through screen-share to install AnyDesk or Quick Assist and even sending them to fake login pages to steal passwords and MFA codes. Here’s the scary part: they don’t even have to touch industrial controls. Dragos saw over a thousand industrial ransomware incidents in one quarter, just knocking out business IT systems like ERP and identity was enough to stop factories, like a sugar mill that had to halt cane haulage. So if “IT” pings you on Teams out of the blue, don’t screen-share, don’t install anything. Stop, and contact the helpdesk through our official channel to confirm first.
Researchers reported a months-long campaign where attackers used Microsoft Teams chats/calls while pretending to be IT/help desk support. Victims were talked into starting remote-control sessions (Quick Assist or RemSupp), after which the attackers used PowerShell to maintain access and, in some…
Attackers are calling employees on Microsoft Teams while pretending to be internal IT support, then persuading them to approve a Microsoft Quick Assist remote-control session. Once the employee approves, the attacker can take control of the computer and use PowerShell to install a Go-based backdoor…
A legal-sector threat intel report says adversary-in-the-middle (AiTM) phishing is now the most common way attackers gain initial access to law firms, because it can bypass MFA by stealing valid session cookies. The report highlights deadline-driven lures (fake document/court portal errors) and…
This weekly roundup describes multiple real-world campaigns where attackers trick people using familiar brands and “verification” prompts to steal credentials or install remote-control tools. The common theme is trust abuse: messages and web pages look legitimate, then push users to log in, click…
Researchers described a now-patched flaw ("AgentForger") where a single benign-looking ChatGPT link could silently create and publish an attacker-controlled Workspace Agent inside a company. If an employee was already logged in and had connected apps (like email, Drive, Slack, or Teams), the agent…
Microsoft reported that phishing tied to the Tycoon2FA phishing-as-a-service platform dropped sharply after a disruption, pushing attackers to change tactics rather than stop. The report highlights real campaigns that shifted toward Microsoft Teams-based social engineering, highly automated BEC…
