OTX BotNew A0Backdoor Linked to Teams Impersonation and Quick Assist Social Engineering
A new backdoor, dubbed A0Backdoor, has been discovered in connection with a campaign using email bombing and IT-support impersonation over Microsoft Teams to gain Quick Assist access. The malware's loader exhibits anti-sandbox evasion techniques, and the campaign's command-and-control has shifted to a covert DNS mail exchange-based channel. This activity is attributed to the threat group Blitz Brigantine, also known as Storm-1811 or STAC5777, and shows similarities to Black Basta-linked social-engineering tactics. The attackers use digitally signed MSI packages, often hosted on Microsoft cloud storage, to deliver their proprietary tooling. The A0Backdoor employs sophisticated techniques such as time-based execution windows, runtime decryption, and DNS tunneling for covert communication. The campaign has been active since August 2025, targeting primarily the finance and health sectors.
Pulse ID: 69abf37e75ba997149f9e95c
Pulse Link: https://otx.alienvault.com/pulse/69abf37e75ba997149f9e95c
Pulse Author: AlienVault
Created: 2026-03-07 09:44:29
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#BackDoor #BlackBasta #Cloud #CyberSecurity #DNS #Email #ICS #InfoSec #Malware #Microsoft #MicrosoftTeams #OTX #OpenThreatExchange #SocialEngineering #Windows #bot #AlienVault
ransomNews
Marcel SIneM(S)US
TechNadu
The New Oil
Tommy Kavanagh
chirp
CyberVeille.ch
gaby_wald
Tinker ☀️