Two ransomware campaigns using “email bombing,” Microsoft Teams “vishing”

    Wednesday, January 22, 2025 In: Threat Research Print

    Date: 01/22/2025

    Severity: High

    Summary

    Our team is actively responding to incidents involving two distinct threat actor groups leveraging Microsoft Office 365 to infiltrate organizations, likely aiming to steal data and deploy ransomware. Investigations into these clusters began following customer incidents in November and December 2024, with the threats tracked as STAC5143 and STAC5777. Both groups operated their own Office 365 tenants and exploited a default Microsoft Teams configuration allowing users from external domains to initiate chats or meetings with internal users.

    Indicators of Compromise (IOC) List

    IP Address : 

    74.178.90.36

    195.123.241.24

    207.90.238.46

    78.46.67.201 

    207.90.238.99

    109.107.170.2

    195.133.1.117

    206.206.123.75

    194.87.39.183

    Hash :

    f009ec775b2daa5a0f38dc2593a3c231611bea7cb579363915d9be1135b00455

3d0e55bd3c84e6cb35559ef1d0f2ef72a21e0f3793a9158d514f12f46b0aff85

801525d7239e46f9c22d7e7bcd163abcfb29fc0770ff417f5fc62bfb005ec7ac 

ea2b3bf32cc27e959e19c365fa2f6e5310ef2e76d3d0ed2df3fb5945f9afc9e7

4b6a008c8b85803dc19a8286f33cad963425d37c4ca0b1a9454a854db3273dad

a23560a3b9a9578dcd70bcd01434b2053940d6be36e543df8e4d36931ca9ea63 

4b33c3e3b4b26df0e8efd58e88594a7ee2bd98899451b63d1140eabbca2180a171dc88874b9dcae1f43e312d9e556826b60c1fb

42d09288a78363cac90759ddce814a420f22d174768c1e406bf2d8fed2c38ade

8abc8c92ebfe78f54e7488a467d1b6e90d28382067b49a954e31133691112eba

697d5213d69cdfbd943c6d395f907b8fe210bbfc9d78a9d41a046ba55bebb5ff

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    IP Address : 

    dstipaddress IN ("207.90.238.99","195.133.1.117","195.123.241.24","194.87.39.183","207.90.238.46","78.46.67.201","109.107.170.2","206.206.123.75") or ipaddress IN ("207.90.238.99","195.133.1.117","195.123.241.24","194.87.39.183","207.90.238.46","78.46.67.201","109.107.170.2","206.206.123.75") or publicipaddress IN ("207.90.238.99","195.133.1.117","195.123.241.24","194.87.39.183","207.90.238.46","78.46.67.201","109.107.170.2","206.206.123.75") or srcipaddress IN ("207.90.238.99","195.133.1.117","195.123.241.24","194.87.39.183","207.90.238.46","78.46.67.201","109.107.170.2","206.206.123.75")

    Hash :

    sha256hash IN ("697d5213d69cdfbd943c6d395f907b8fe210bbfc9d78a9d41a046ba55bebb5ff","a23560a3b9a9578dcd70bcd01434b2053940d6be36e543df8e4d36931ca9ea63","f009ec775b2daa5a0f38dc2593a3c231611bea7cb579363915d9be1135b00455","3d0e55bd3c84e6cb35559ef1d0f2ef72a21e0f3793a9158d514f12f46b0aff85","801525d7239e46f9c22d7e7bcd163abcfb29fc0770ff417f5fc62bfb005ec7ac","ea2b3bf32cc27e959e19c365fa2f6e5310ef2e76d3d0ed2df3fb5945f9afc9e7","4b6a008c8b85803dc19a8286f33cad963425d37c4ca0b1a9454a854db3273dad","4b33c3e3b4b26df0e8efd58e88594a7ee2bd98899451b63d1140eabbca2180a171dc88874b9dcae1f43e312d9e556826b60c1fb","42d09288a78363cac90759ddce814a420f22d174768c1e406bf2d8fed2c38ade","8abc8c92ebfe78f54e7488a467d1b6e90d28382067b49a954e31133691112eba")

    Reference:   

    https://news.sophos.com/en-us/2025/01/21/sophos-mdr-tracks-two-ransomware-campaigns-using-email-bombing-microsoft-teams-vishing/ 


    Tags

    MalwareRansomwareVishing

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2025 by Gurucul - All rights reserved.