Hackers are using Microsoft Teams to conduct “email bombing” attacks

Threat actors are posing as tech support workers to launch attacks through Microsoft Teams, according to a report from Sophos.

The firm is tracking two threats dubbed STAC5143 and STAC5777, having first begun investigating clusters of activity in November and December 2024. Both threat actors used their own Microsoft 365 tenants as part of their attacks.

Attackers took advantage of a default Microsoft Teams configuration that allows users on external domains to start chats or meetings with internal users, Sophos said.

While STAC5143 is a previously unreported threat, STAC5777 has been identified by Microsoft as Storm-1811. STAC5143 may have connections to a threat actor known also as FIN7, Sangria Tempest, or Carbon Spider.

‘We are publishing this in-depth report on both threat clusters to aid defenders in detecting and blocking these continuing threats, and to raise awareness of the spread of these tactics among organizations using the Office 365 platform,” Sophos MDR said.

The firm claims to have observed over 15 incidents involving these tactics over the past three months, with half conducted in the past two weeks.

"Email bombing is not a new technique, but it is an effective technique that has been on the rise due to the increase in free mail bombing tools and mail bombing services that will sign up users to a long list of free email subscriptions for a price,” Chance Caldwell, Senior Director at Cofense, told ITPro.

“These spamming techniques are used in a wide array of attacks with varying objectives, but they are all trying to obscure their activity by hiding behind the hundreds if not thousands of emails being sent to the user,” he added.

How can businesses be prepared?

These attacks are difficult to spot, Caldwell said, as traditional security tools do not recognize the spam emails being sent. On the other hand, blocking emails at a large scale could lead to legitimate emails being impacted.

“Employees should be taught the proper communication methods with their company's internal help desk or security teams to ensure that they do not fall for a threat actor's attempts to engage with them under the pretense of providing tech support," Caldwell said.

Organizations should also ensure employees know which Remote Access Tools their organization uses, according to Max Gannon, Intelligence Manager at Cofense.

“Simply creating a list of approved tools and ensuring employees know what is on it can help defend against attacks such as these," Gannon told ITPro.