Dragos reports that ransomware operators are increasingly disrupting industrial production by targeting the business IT systems that support operations, even without touching industrial control systems. The report highlights real-world social engineering where attackers impersonate internal IT on Microsoft Teams to persuade employees to screen-share and install remote access tools, and also notes a separate FBI warning about fake on-site “IT technicians” plugging in USB drives.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: a Teams chat pops up, “Hi, this is IT Support. Start a screen-share so we can install our monitoring tool.” Ransomware groups are doing exactly this, posing as internal IT on Teams, then walking people through screen-share to install AnyDesk or Quick Assist and even sending them to fake login pages to steal passwords and MFA codes. Here’s the scary part: they don’t even have to touch industrial controls. Dragos saw over a thousand industrial ransomware incidents in one quarter, just knocking out business IT systems like ERP and identity was enough to stop factories, like a sugar mill that had to halt cane haulage. So if “IT” pings you on Teams out of the blue, don’t screen-share, don’t install anything. Stop, and contact the helpdesk through our official channel to confirm first.
Attackers are using Microsoft Teams external chat to pose as internal IT support staff, often after overwhelming employees with email subscription messages. They persuade victims to join a voice call, approve remote-control tools, or run commands, with some incidents ending in malware infections…
Attackers impersonated IT help desk staff through phone calls, email, and Microsoft Teams, using employees’ names and email addresses to appear legitimate. They persuaded users to open remote-access sessions, and one such session led to a ransomware incident. The campaigns did not focus only on…
Microsoft investigated two real intrusions in which attackers impersonated IT support staff through Microsoft Teams messages and calls. They persuaded users to open Quick Assist and share a connection code, then used the remote session to pursue high-impact access to privileged accounts and domain…
Attackers used external Microsoft Teams chats to impersonate internal IT support and convince employees to grant remote access to their Windows computers. In many cases, they first flooded inboxes with subscriptions or confirmation emails, then offered fake assistance and persuaded victims to use…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
Researchers say the Iran-linked group Nimbus Manticore posed as recruiters on LinkedIn and job platforms to send developers “technical challenge” ZIP files that secretly installed cross-platform remote access trojans. The lures used urgency (short test windows) and realistic developer workflows…
