🚨 ACTIVE EXPLOITATION
- Attackers abuse Microsoft Teams external chats in recurring IT support impersonation scams
Arctic Wolf Labs has documented a recurring social engineering pattern in which attackers impersonate IT support via Microsoft Teams external chats to gain remote access and deploy malware or ransomware.- Targets organizations with Microsoft Teams external access enabled; hundreds of cases show consistent attacker behavior including throwaway tenants, 'IT Support (Internal)' display names, and shared remote-access tools.
- Attackers use *.onmicrosoft[.]com fallback domains (e.g., helpdeskteam365.onmicrosoft[.]com) and paid TLDs — about 50% .top, 40% .com — often linked to activity tracked as STAC4749.
- Attacks are preceded by mail bombing to create urgency, then vishing via Teams to get victims to grant remote access through RMM tools like Quick Assist, AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport, and LogMeIn.
- Remote access is used for reconnaissance, deploying the GoGRPC backdoor, lateral movement to domain controllers, installing redundant RMM tools, exfiltrating data, and dropping Chaos ransomware.
- In one case, a PowerShell command downloaded an MSI from Azure Blob Storage that extracted a Python backdoor performing LDAP queries against Active Directory and exfiltrating results.
💥 BREACHES & INCIDENTS
- Emperador ransomware group claims theft of 3.9GB of AB InBev data, demands $1M in Bitcoin
The Emperador ransomware group has claimed on its leak site that it stole 3.9GB of data from AB InBev and is demanding $1 million in Bitcoin.- Applies to AB InBev, the Belgium-based world's largest brewer (Budweiser, Corona, Stella Artois); the claim was discovered October 25, 2026, and AB InBev has not confirmed any breach.
- Emperador claims 329,244 social-listening alerts, 2,510 corporate emails across subsidiaries, ~19,000 access logs, GBS portal records, internal PKI certificates, and 3.2GB of Azure Blob assets.
- The claim is unverified: the listing does not prove private keys were taken, explain how Azure assets were obtained, or show that systems were encrypted or operations disrupted.
- Ransom demand is $1 million in Bitcoin with a deadline around November 23, 2026; Emperador, first observed September 2026, uses double-extortion tactics including leak-site shaming and threats to contact employees, customers, and partners.
Sources 📄 Source: ransomware.live · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
🔓 CVEs & KEV
CVE-2026-105608 — HashiCorp Consul — CVSS 8.8 — Consul vulnerable to an authorization bypass in service mesh registrationHash...
CVE-2026-115915 — vllm-project vllm — CVSS 8.1 — vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCEvL...
CVE-2026-105765 — HashiCorp Consul — CVSS 7.5 — HCSEC-2026-46 - Consul vulnerable to an authorization bypass in the agent's s...
CVE-2026-115918 — vllm-project vllm — CVSS 6.5 — vLLM: Responses API bypasses trust_request_chat_template for chat_template_kw...
CVE-2026-115916 — vllm-project vllm — CVSS 6.5 — vLLM: Out-of-vocabulary prompt token id passes input validation and triggers ...
🕵️ RESEARCH & DEEP DIVES
- Attackers abuse Microsoft Teams external chats in recurring IT support impersonation scams
Arctic Wolf Labs has documented a recurring social engineering pattern in which attackers impersonate IT support via Microsoft Teams external chats to gain remote access and deploy malware or ransomware.- Targets organizations with Microsoft Teams external access enabled; hundreds of cases show consistent attacker behavior including throwaway tenants, 'IT Support (Internal)' display names, and shared remote-access tools.
- Attackers use *.onmicrosoft[.]com fallback domains (e.g., helpdeskteam365.onmicrosoft[.]com) and paid TLDs — about 50% .top, 40% .com — often linked to activity tracked as STAC4749.
- Attacks are preceded by mail bombing to create urgency, then vishing via Teams to get victims to grant remote access through RMM tools like Quick Assist, AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport, and LogMeIn.
- Remote access is used for reconnaissance, deploying the GoGRPC backdoor, lateral movement to domain controllers, installing redundant RMM tools, exfiltrating data, and dropping Chaos ransomware.
- In one case, a PowerShell command downloaded an MSI from Azure Blob Storage that extracted a Python backdoor performing LDAP queries against Active Directory and exfiltrating results.
📋 ADVISORIES
- 📄 Source for CISA releases 'CISA 2030: Defend, Harden, Prevail' strategic plan for next four years — us-cert.cisa.gov