Disrupting threats targeting Microsoft Teams

The Microsoft Threat Intelligence post explains that Microsoft Teams’ extensive collaboration features and global adoption make it a high‑value target for cyber criminals and state‑sponsored actors, who abuse its messaging, calls and meetings and even video‑based screen sharing at multiple points along the attack chain.

According to Microsoft Threat Intelligence, the piece surveys stages from reconnaissance and initial access to persistence, lateral movement, and exfiltration, illustrating how threat actors leverage tools, branding, and external relationships to gain and maintain access.

The article names several threat actors and campaigns as examples, including Storm‑1811 impersonating tech support, Storm‑2372’s device‑code phishing to steal sessions, Octo Tempest’s MFA targeting, and VEILdrive activity by Sangria Tempest and Storm‑1674 to impersonate IT personnel via Teams; it also references Peach Sandstorm and others delivering malicious payloads through ZIP files or Teams channels.

It notes how adversaries reuse legitimate Teams features such as scheduling private meetings or using TeamsPhisher tooling to distribute malware, while emphasising that threat actors may rely on external advertising or AiTM techniques to misdirect users. Mitigation guidance then focuses on strengthening identity protection, hardening endpoints, securing Teams clients, and raising awareness, with a practical emphasis on Entra ID protections, conditional access, and Defender for Office 365 controls.

The post also highlights the role of Defender XDR detections and advanced hunting queries to detect and respond to Teams‑oriented threats, including monitoring for malicious links, suspicious sign‑ins, and external help‑desk interactions.