The Attack: Social Engineering Through Trusted Collaboration Tools
In 2026, threat actors launched a sophisticated campaign that exploited Microsoft Teams’ external chat feature to deliver ransomware across hundreds of organizations. The attackers didn’t exploit a software vulnerability. They exploited trust.
The attack chain started with mail bombing to overwhelm victim inboxes and create urgency. Then attackers initiated Microsoft Teams chats from newly created tenants using IT-themed display names like “IT Support Internal” or “HelpDesk Manager.” Through vishing within the Teams chat, they convinced users to install legitimate remote management tools: Quick Assist, AnyDesk, ScreenConnect, Atera, TeamViewer, NetSupport, Zoho Assist, and LogMeIn.
Once the attacker had hands-on-keyboard access through these legitimate RMM tools, they escalated privileges, deployed the GoGRPC backdoor, conducted Active Directory reconnaissance via LDAP queries, moved laterally to domain controllers, exfiltrated sensitive data to external servers, and finally deployed Chaos ransomware.
The article emphasizes the need for Zero Trust segmentation, egress controls, and anomaly detection. Those are all valid downstream controls. But there’s a simpler, more upstream intervention point: the moment the backdoor tries to land on the file system.
Where FileSure Intervenes: Before the Backdoor Lands
FileSure Defend operates at the Windows kernel level via a filter driver that intercepts file system operations before they complete. It doesn’t matter whether the delivery mechanism is a phishing email, a browser download, or a legitimate remote access tool — if an unauthorized program attempts to write an executable file to disk, FileSure blocks it.
In this attack scenario, the critical moment is when the attacker uses the RMM tool to drop the GoGRPC backdoor onto the compromised system. That’s a file write operation. If you’ve defined a policy that says “AnyDesk, Quick Assist, and Atera are not authorized to write executable files to this system,” then the backdoor never lands.
No backdoor on disk means no lateral movement. No lateral movement means no domain controller compromise. No domain controller compromise means no Chaos ransomware deployment.
Here’s what that rule looks like in FileSure:
Operation: Block file create and file write
File type filter: *.exe, *.dll, *.bat, *.ps1, *.vbs
Program name filter: anydesk.exe, quickassist.exe, atera.exe, screenconnect.exe, teamviewer.exe, netsupport.exe, zohoassist.exe, logmein.exe
Action: Block and alert
You can deploy this rule across your entire environment from the management console. It applies immediately. If an attacker gains access through one of these tools and tries to write a payload, the operation is blocked at the kernel level before the file is created. The attempt is logged. Your monitoring system gets an alert.
The user who was tricked into granting access doesn’t even know the attack failed. The attacker’s session stays open, but they can’t do anything useful because they can’t land their tools.
Why This Works Against Social Engineering
Traditional security controls try to prevent the social engineering itself: user training, phishing simulations, external tenant restrictions in Teams, multi-factor authentication on remote access sessions. Those are all good ideas. They reduce the probability of compromise.
But they don’t reduce it to zero. Normal people get tricked. IT-themed display names are convincing. Mail bombing creates real urgency. MFA doesn’t help if the user is actively cooperating with the attacker.
FileSure doesn’t try to prevent the social engineering. It assumes the social engineering succeeds. It assumes the attacker gets remote access. Then it enforces a simple rule: you can remote in, but you can’t write executables to disk.
That’s a durable control. It doesn’t depend on user behavior. It doesn’t depend on recognizing the specific malware variant. It doesn’t require signature updates. It works the same way against Chaos ransomware, the next ransomware variant that appears tomorrow, and the custom backdoor the attacker wrote specifically for your environment.
The article describes this as a “durable, scalable playbook that security teams must treat as an ongoing threat.” They’re right. Attackers will keep using this pattern because it works. Blocking executable writes from RMM tools is the durable defense.
Ready to stop ransomware before it starts? FileSure Defend gives you kernel-level control over file operations across every Windows system you manage — from legacy servers to modern workstations. Start your free 21-day trial at bystorm.com.
Source: Microsoft Teams IT Support Scams Deploy Chaos Ransomware | Aviatrix Threat Research
Category: Ransomware
Tags: chaos ransomware, microsoft teams, social engineering, rmm tools, anydesk, gogRPC backdoor, kernel filter driver, file system security
