ºÚÁÏÉç

Threat?Summary

Arctic Wolf?observed?two independent intrusions?(on?June 23?and?July?6),?each beginning with?external Microsoft Teams social engineering?that convinced users to start a?Quick Assist?remote?assistance?session and grant?the attacker?control of their Windows workstations. Both environments were?domain?joined?enterprise systems?with standard productivity tooling and endpoint security controls in place, underscoring that this tradecraft?can be?effective even in?relatively mature?environments.?

In the?June 23?incident (Intrusion 1), the actor compromised a?U.S. food?and?beverage?organization. Within minutes of obtaining Quick Assist access, they executed?PowerShell reconnaissance, exfiltrated host details to attacker infrastructure, and then delivered three payload ¡°waves¡±: an Adobe?themed MSI dropping a?Rust?based reverse?SOCKS proxy (accc.exe), a standalone binary (feature.exe), and a second MSI dropping vortexcore.exe?with Startup folder persistence.?

In the?July 6?incident (Intrusion 2), an international manufacturing?organization?had multiple users in Germany targeted. The actor repeated the same?high?level playbook across three users in sequence: Teams helpdesk pretext plus email bombing, Quick Assist compromise, download of systemcheck.zip, and execution of a fake Windows security update flow that culminated in deployment of Xray-core as ChromeUpdate.exe¡ªa VLESS+Reality tunneling implant with persistence via a deceptive GoogleChromeUpdateCore?Run key or hidden scheduled task.?

Abuse of Trusted Microsoft Workflows and Cloud Infrastructure?

In both?cases,?the threat actor?avoided custom?first?stage?malware?in favor of trusted, Microsoft-branded workflows. Initial contact and social engineering were conducted over?Microsoft?Teams, remote access was obtained via?Quick Assist?(signed,?built?in?Windows?component), and payload staging?leveraged?Microsoft SharePoint?and?DevTunnels.?Additional?payload hosting used?GitHub, Dropbox, and?Cloudflare?fronted?domains?to further blend into?organization?typical?traffic.?

This?¡°live off the SaaS land¡±?strategy is significant because it?sidesteps email security controls and URL?reputation?only defenses. For example, in Intrusion 1, all three PowerShell loaders (val.ps1?variants) were hosted on an attacker?controlled?SharePoint tenant, and payload MSIs and executables were fetched from Cloudflare?fronted .online?domains with short registration histories.?

Because?Quick Assist sessions are often under?logged by default?and the surrounding traffic appears legitimate, organizations that lack detailed endpoint telemetry (EDR/Sysmon) and strong SaaS observability are particularly vulnerable. This raises the importance of remote?support governance and behavioral analytics that can correlate human?assistance workflows with unusual follow?on activity.?

Key Takeaways from Both Campaigns?

Across both intrusions, several?patterns?emerge:?

• Social engineering + Quick Assist?is the primary initial?access vector, not a software exploit.?

• PowerShell?is the central execution engine, driving reconnaissance, payload download, and installer orchestration.?

• Multi?payload?redundancy?is used to race EDR controls and ensure at least one implant successfully persists.?

• Persistence?is achieved via?Run keys, Startup folder shortcuts, and scheduled tasks,?themed as benign software?updaters.?

• Final implants?are?encrypted tunneling proxies,?indicating?an?access?enablement?objective?rather than immediate ransomware or data destruction. There was no lateral movement?observed.?

From a defender¡¯s perspective, this means?no single IOC is durable: domains, IPs, and hashes can and will rotate. The resilient detection axis is the?sequence of behaviors¡ªTeams?contact from external identities, Quick Assist invocation, archive/script execution, new persistence creation, and unusual encrypted outbound connections from user workstations.?

Why This Matters Now?

The?convergence of tradecraft across two?seemingly unrelated?teams?¡ª different sectors, geographies, and tunneling tool families ¡ª suggests this could?represent?either a?shared ¡°playbook¡±?circulating in underground communities?or the same operator evolving their tooling between operations.?

In practical terms, this means:?

• Defenders should not over?focus on any single malware?family,?but?instead anchor detection on?abuse of remote?assistance?+ behavioral persistence + tunneling.?

• Organizations that?permit?external Teams contacts?but lack user training and conditional access policies face rising risk of similar compromises.?

• The presence of?encrypted tunnels and locally harvested credentials?significantly increases the potential impact, even in cases where no lateral movement or exfiltration has yet been?observed.?

Given the continuing adoption of Microsoft Teams and the?default availability of Quick Assist in modern Windows builds, this attack surface is both widespread and likely to remain attractive to adversaries.?

How?Arctic Wolf?Protects its Customers?

Arctic Wolf? Threat Research, Detection Engineering, and Managed Detection and Response (MDR) teams have already?incorporated the observed TTPs and IOCs into stateful and behavior?based detections, including rules that:?

• Correlate?Quick Assist execution?with?archive/script downloads?and?subsequent?persistence changes.?

• Flag?external Teams chats?from untrusted domains that precede Quick Assist sessions and unusual PowerShell activity.?

• Detect?suspicious Run key and scheduled task names?

Operational and Business Impacts

Even in the absence of confirmed lateral movement or data exfiltration, the observed tradecraft creates several?high?impact?conditions:?

• Account compromise and impersonation:?Users?may?willingly grant Quick Assist control, allowing actors to perform any action available to the?logged?in?account, including credential changes, MFA registration manipulations, and local configuration tampering.?

• Persistent covert access:?Run keys, Startup shortcuts, and SYSTEM scheduled tasks?create?auto?start?tunnels?that may survive reboots and normal IT operations.?

• Defense evasion:?Masquerading as?Adobe or Chrome updaters?and?leveraging?trusted cloud infrastructure?make these implants far harder to catch with?signature?only?approaches or?allow?lists.?

• Regulatory and reputational exposure:?If tunneled access is used to exfiltrate sensitive customer or IP data, organizations could face?breach?notification obligations, regulatory scrutiny, and reputational damage,?even if no ransomware event occurs.?

Organizations that do?not?centrally manage?remote?support?tooling,?or that allow external Teams?contact?by default, face a particularly elevated risk of silent foothold establishment.?

Recent Trends and Broader Threat Landscape?

The observed tradecraft is not isolated; it reflects a broader and escalating threat landscape in which adversaries increasingly abuse trusted remote-support workflows, collaboration platforms, and cloud infrastructure to gain access while blending into normal enterprise activity.?

Since?April 2024, Arctic Wolf and other vendors have tracked?Black Basta?ransomware affiliates?abusing Windows Quick Assist (and increasingly Microsoft Teams) in?vishing?enabled?social engineering campaigns?to gain interactive access, deploy?Qakbot?or RMM tools?and ultimately, ransomware.?

More broadly, Arctic Wolf has documented?Quick Assist and other remote support tool abuse?in multiple environments, often combined with?email bombing?and?Teams?impersonation?to pressure users into accepting remote sessions. This places the two June¨CJuly 2026 intrusions squarely within a?larger criminal ecosystem?that favors?legitimate?remote?support?and RMM tooling?as stealthy entry points.?

Key trends that increase the urgency of addressing this vector include:?

• Email bombing?and?vishing?being operationalized in more campaigns to create ¡°urgent¡± support scenarios that drive Quick Assist usage.?

• Expansion from?phone calls to?Microsoft?Teams?based?impersonation, lowering friction and making it easier?for attackers?to?reach?a wide set of users in modern enterprises.?

• Increasing abuse of?DevTunnels, cloud storage, and?GitHub?as payload hosts, making simple domain blocking less effective.?

• Despite Microsoft adding more?on?screen?warnings?and?scam?education prompts to Quick Assist in 2025, user?behavior under pressure?remains?the weakest link.?

Taken together, these trends point to?continuing and?likely expanding?abuse?of remote-support channels in 2026¨C2027.?

Hardening and Prevention

Remote Support Controls?

• Disable or remove Quick Assist?wherever it is not explicitly?required?for business operations. This can be enforced via?Group Policy, Intune, or?application?removal.?

• Where remote?assistance?is necessary, standardize on?managed tools?that provide logging?

Application Control and Script Governance?

• Deploy?application whitelisting?(e.g., Windows Defender Application Control, AppLocker) to?block or?prompt on?unsigned binaries?executing from?user?writable?paths.?

• Restrict?PowerShell?usage?to?signed scripts?and?administrative contexts.?

• Monitor for?and block unusual processes?using?updater?themed names (ChromeUpdate.exe, AdobeCreativeCloud, etc.) from?non?standard?directories.?

Identity and Access Management?

• Enforce?MFA?for all?users, and?mandate?phishing?resistant?factors (FIDO2/WebAuthn)?for privileged or?high?risk?roles where?feasible.?

• Implement?conditional access?and anomaly detection?(e.g., impossible travel, unusual ASNs), especially for logons following Quick Assist events.?

Network and Egress Controls?

• Restrict or tightly?monitor?access?from user endpoints to?newly registered, rarely seen, or untrusted TLD domains.?

• Consider?egress?allow?listing?for sensitive segments, ensuring only approved services (e.g., corporate SaaS, update servers) are reachable.?

User Awareness and Process?

• Update?security?awareness?training?to explicitly cover:?

• Teams?based?impersonation?and?remote support?scams.?

• The principle that?IT will never request a Quick Assist session via unsolicited external chats or calls.?

• Define and communicate?clear internal procedures?for verifying remote-support requests (e.g., via corporate ticketing system or official directory?look?up) before any session is allowed.?

• For those without the time or resources to create a security-awareness training program from scratch,?Arctic Wolf Managed Security Awareness??ends human risk by delivering relevant microlearning content?to employees.?

Conclusion

The two Quick Assist¨Cenabled intrusions analyzed in this bulletin?demonstrate?a?mature, repeatable intrusion playbook?that:?

• Starts with people, not exploits,?leveraging?Teams?based?impersonation and phone/email pressure to?co?opt?users into launching Quick Assist.?

• Deploys?multi?stage,?cloud?hosted?payloads?via PowerShell and trusted infrastructure.?

Establishes?encrypted tunnels and durable persistence?designed?for?follow?on exploitation?rather than immediate smash?and?grab activity.?

The?takeaway?is that organizations must treat?built?in?remote support capabilities as?high?risk,?high?impact?attack?surfaces?and?design?controls accordingly. The most robust defense is?behavioral detection and strict governance?over when, how, and by whom remote support?tools may be used?–?not reliance on blocking a particular malware strain or IP address.?

References

• ?

• /resources/blog/black-basta-ransomware-group-affiliates-leveraging-windows-quick-assist-initial-access/?

• ?