Updated October 2026: This post has been expanded from its original October 2024 version with the full sequence of the attack, Microsoft’s and ReliaQuest’s defensive advice, and what happened to Black Basta in 2025. It is a historical account; details describe the time it covers, not today.
In October 2024, the security firm ReliaQuest reported that affiliates of the Black Basta ransomware operation had found a new way to reach employees: Microsoft Teams. After burying a target’s inbox under a flood of junk email, the attackers would message the employee on Teams, posing as the company’s IT help desk and offering to fix the spam problem. The real goal was to get the employee to hand over remote control of their computer.
The technique worked because it exploited something people are trained to do: accept help from IT. This post explains how the scheme unfolded, who Black Basta were, what defenders were advised to do, and how the group fared afterward. The defensive steps remain relevant, because help-desk impersonation remains a common way for attackers to get a foot in the door.
Who Black Basta were
Black Basta appeared in April 2022. Researchers widely believed it was one of the groups that formed after the Conti ransomware syndicate shut down in June 2022. Like other modern ransomware operations, Black Basta stole data before encrypting systems, then threatened to publish it if the victim did not pay.
A joint advisory from CISA and the FBI said Black Basta affiliates had breached more than 500 organizations between April 2022 and May 2024, including critical infrastructure. Publicly reported victims included the UK utility Southern Water, which put its costs from a February 2024 attack at £4.5 million, and electronics manufacturer Keytronic, which reported losses of more than $17 million. The group got in through unpatched vulnerabilities, partnerships with malware botnets, and, increasingly, social engineering.
How the attack worked
Step 1: The email bomb
The campaign began well before Teams entered the picture. In spring 2024, Microsoft, Rapid7 and ReliaQuest described attackers signing a target’s address up for large numbers of newsletters, sign-up confirmations and other mostly harmless messages. The result was an inbox flooded with thousands of emails, which is both alarming and genuinely disruptive. Microsoft tracked the actor behind this activity as Storm-1811 and linked it to Black Basta deployments.
Step 2: The fake help desk
Originally, the attackers then phoned the employee, posing as IT support. By late May 2024, Microsoft had also seen them making contact through Teams. ReliaQuest’s October report described how this worked:
- The attackers created their own Microsoft Entra ID tenants with official-sounding names, such as
securityadminhelper.onmicrosoft[.]com,supportserviceadmin.onmicrosoft[.]com,supportadministrator.onmicrosoft[.]comandcybersecurityadmin.onmicrosoft[.]com. - They contacted employees as external Teams users, usually with a display name containing “Help Desk,” padded with spaces so it appeared centered in the chat window.
- Targets were typically added to a one-on-one chat.
- In some cases the attackers sent QR codes linking to a domain,
qr-s1[.]com. ReliaQuest could not determine what the codes were for. - ReliaQuest said the external accounts appeared to originate from Russia, with time zone data regularly pointing to Moscow.
Step 3: Remote access
The “help desk” would then ask the employee to install AnyDesk or open Windows Quick Assist, a remote support tool built into Windows. Quick Assist requires the user to enter a security code and approve screen sharing and control, which the attacker would walk the victim through.
Step 4: Malware and ransomware
Once connected, the attackers ran files with reassuring names such as AntispamAccount.exe, AntispamUpdate.exe and AntispamConnectUS.exe. Researchers flagged one as SystemBC, a proxy malware Black Basta had used before. Microsoft’s earlier analysis described the group using tools such as Qakbot, Cobalt Strike, ScreenConnect and NetSupport Manager to keep access and move through the network, and ultimately using PsExec to deploy Black Basta ransomware across it.
- Hour 0
Target’s inbox is flooded with thousands of sign-up and newsletter emails - Shortly after
“Help Desk” contacts the target by phone or as an external Teams user - Minutes later
Target is talked into opening Quick Assist or installing AnyDesk - Same session
Attacker runs “antispam” files that install proxy and remote-access malware - Later
Attacker spreads through the network and deploys ransomware
How to defend against it
Microsoft and ReliaQuest published specific recommendations. They map neatly onto each step of the attack.
| Attack step | Defense | Who does it |
|---|---|---|
| External Teams message from “Help Desk” | Restrict external Teams communication, or allow it only from trusted domains | IT admin |
| Fake support chat | Check for the “External” label on messages; never share account details or approve sign-ins over chat | Every employee |
| Quick Assist session | Remove or block Quick Assist if unused; use a managed tool such as Intune Remote Help instead | IT admin |
| Remote control request | Only accept remote sessions you started yourself with your known IT team | Every employee |
| Credential theft | Require phishing-resistant authentication for critical apps | IT admin |
| Suspicious chats | Enable logging, especially the Teams ChatCreated event, and review it | Security team |
Sources: Microsoft Threat Intelligence (May 15, 2024); ReliaQuest recommendations as reported by BleepingComputer (October 25, 2024).
For employees
- Treat unexpected IT contact with suspicion, especially right after something alarming happens, like an inbox flood. Attackers create the problem and then offer to fix it.
- Verify through a channel you already know. Call or message your IT team using the contact details on your company intranet, not the ones offered in the chat.
- Look at who is messaging you. Real internal staff do not normally appear with an “External” tag or an unfamiliar company domain.
- Never install remote access software on request unless you opened the support ticket yourself.
- Report it. Even if you are unsure, tell your security team. A sudden email flood is itself a warning sign worth reporting.
For IT and security teams
Review your Teams external access settings, decide which outside organizations genuinely need to message staff, and block the rest. Audit which remote support tools are installed and remove the ones you do not use. Train help-desk staff and employees on how real IT will contact them, so that anything outside that pattern stands out.
What happened next
Black Basta’s run did not last much longer. In February 2025, someone leaked the group’s internal Matrix chat logs, covering September 2023 to September 2024. The threat intelligence firm PRODAFT said the group had been mostly inactive since the start of 2025 because of internal conflicts, and that some operators had allegedly collected ransoms without providing working decryptors. The leaked chats gave researchers a rare inside view of how the group chose targets and handled negotiations.
Researchers later reported that the Cactus ransomware operation used the same kind of help-desk social engineering, along with shared malware, which suggested the playbook was spreading. German and Ukrainian law enforcement said they had identified the group’s alleged leader and added him to Europol and Interpol wanted lists.
The bottom line
Black Basta’s Teams campaign did not rely on a software flaw. It relied on a plausible story and a tool built into Windows. The fix is a combination of tighter settings, such as limiting external Teams access and removing unused remote support tools, and a simple habit for every employee: if IT contacts you out of the blue, check with IT before doing anything.
Sources
- BleepingComputer: Black Basta ransomware poses as IT support on Microsoft Teams
- Microsoft Threat Intelligence: Threat actors misusing Quick Assist in social engineering attacks leading to ransomware
- BleepingComputer: Black Basta ransomware gang’s internal chat logs leak online
- BleepingComputer: Black Basta coverage (CISA/FBI advisory figures, victim reports, leader identification)
Top image: "Home-office-336377" by Free-Photos from Pixabay, CC0 1.0, via Wikimedia Commons (resized). Charts by Thank You Robot.
0 Comments