We rank vendors based on rigorous testing and research, but also take into account your feedback and our commercial agreements with providers. This page contains affiliate links.
Disclosure:
Professional Reviews

vpnMentor contains reviews that are written by our community reviewers. These take into consideration the reviewers’ independent and professional examination of the products/services.

Ownership

vpnMentor was established in 2014 as an independent site reviewing VPN services and covering privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, ZenMate, Private Internet Access, and Intego, which may be reviewed on this website.

Affiliate Commissions Advertising

vpnMentor contains reviews that follow the strict reviewing standards, including ethical standards, that we have adopted. Such standards require that each review will take into consideration the independent, honest and professional examination of the reviewer. That being said, we may earn a commission when a user completes an action using our links, at no additional cost to them. On listicle pages, we rank vendors based on a system that prioritizes the reviewer’s examination of each service, but also considers feedback received from our readers and our commercial agreements with providers.

Reviews Guidelines

The reviews published on vpnMentor are written by community reviewers that examine the products according to our strict reviewing standards. Such standards ensure that each review prioritizes the independent, professional and honest examination of the reviewer, and takes into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings we publish may also take into consideration the affiliate commissions we earn for purchases through links on our website.

Organizations Hit by Phishing Attacks via Microsoft Teams

Organizations Hit by Phishing Attacks via Microsoft Teams
Zane Kennedy Published on 19th September 2023 Cybersecurity Researcher

Microsoft has issued an urgent warning regarding a sophisticated phishing campaign targeting organizations using Microsoft Teams, perpetrated by the notorious threat actor group Storm-0324. In a newly detailed report, Microsoft disclosed that since July 2023, Storm-0324 has begun attempting to distribute malicious payloads through external Teams messages, which could then be used to facilitate ransomware attacks.

The mechanism behind these phishing efforts is an open-source tool, TeamsPhisher, which capitalizes on a previously identified but unaddressed security flaw within Microsoft Teams. This tool allows attackers to attach files to messages to external Teams users, thus allowing for malicious payloads to be attached.

Acting as an access broker, Storm-0324 facilitates the entrance of other malicious actors into compromised networks. Historically, the group has been associated with distributing ransomware strains like Sage and GandCrab. Recently, the threat actor has primarily been known for distributing JSSLoader malware to facilitate access for the ransomware-as-a-service group Sangria Tempest (also known as ELBRUS, Carbon Spider, and FIN7).

It's not just corporations that are under threat. In a concerning twist, APT29, a hacking division of the Russian Foreign Intelligence Service (SVR), was found exploiting the same flaw to target organizations, including government entities. Their modus operandi involved tricking targets into approving multifactor authentication (MFA) prompts, ultimately aiming to steal their credentials. With the network compromised, the politically-motivated hacking group could perform espionage undetected.

Responding to the threat, Microsoft has taken several actions. Accounts that have been detected to be partaking in this malicious behavior have been suspended. In addition, Microsoft has attempted to make it more clear when a message is coming from a user outside your organization.

On the user's end, Microsoft advises restricting external communications on Teams if it isn’t necessary, controlling the types of devices that can connect to Teams, educating employees about social engineering, and much more. Microsoft’s full list of recommendations can be found in its report.

About the Author

Zane is a Cybersecurity Researcher and Writer at vpnMentor. His extensive experience in the tech and cybersecurity industries provides readers with accurate and trustworthy news stories and articles. He aims to help individuals protect themselves through informative content and awareness of cybersecurity's crucial role in today's digital landscape.