Microsoft Warns: Threat Actors Turn Microsoft Teams into a Weapon for Ransomware, Espionage, and Social Engineering

Microsoft Threat Intelligence has released a report detailing how threat actors are weaponising Microsoft Teams to enable ransomware, espionage, and social engineering across enterprise environments. The findings show adversaries abusing Teams’ core capabilities—messaging, calls and meetings, file sharing and external federation—to blend into legitimate communication flows and gain long-term access via reconnaissance of Entra ID and Microsoft Graph API.

Using tools such as TeamsEnum, TeamFiltration and ROADtools, attackers map users, channels and tenant configurations, then register or hijack weakly configured legitimate tenants to stage operations, including hosting phishing campaigns and malware delivery through chat invitations or meeting links.

Notable campaigns include Storm-1811 impersonating tech support to push the ReedBed ransomware loader via remote management tools, and Midnight Blizzard, a Russia-linked group, impersonating security teams to harvest authentication codes and complete MFA flows for access.

The report also notes exploits by Octo Tempest employing social engineering and Teams to obtain MFA resets or federate new domains, and describes how attackers later use tools like AADInternals and AzureHound to enumerate configurations and pivot laterally.

According to Microsoft Threat Intelligence, several actors—ranging from financially motivated groups to state-sponsored operatives—are expanding their use of Teams for data theft, extortion and C2 communications, with chained techniques that can exfiltrate data via webhooks or Adaptive Cards.