Microsoft Teams Used to Install A0Backdoor

Cybersecurity researchers have uncovered a sophisticated attack campaign exploiting Microsoft Teams and Quick Assist to deploy a stealthy malware known as A0Backdoor. This threat, attributed to groups alias Blitz Brigantine, Storm-1811, and STAC5777, has connections to Black Basta ransomware. Active between August 2025 and February 2026, this operation zeroes in on finance and healthcare professionals.

The group initiates its attack by overwhelming inboxes with spam emails, then masquerades as IT support via Microsoft Teams to gain the target’s trust. Once obtained, they exploit Quick Assist to install malicious software camouflaged as legitimate Microsoft tools. Analysts from BlueVoyant identified that the attackers used digitally signed MSI packages resembling authentic updates, enhancing their deceit.

To mitigate risks, organizations are advised to limit Quick Assist use and implement strict verification processes for IT contacts through Microsoft Teams. For comprehensive coverage, read the full report here:

Attackers Abuse Microsoft Teams and Quick Assist to Drop Stealthy A0Backdoor