Malware Delivery via External Teams Chats in 15 Minutes

Introduction

A new wave of social engineering attacks is targeting enterprise collaboration platforms, specifically Microsoft Teams, by abusing external chat functionality to deliver malware at alarming speed. Researchers report that these attacks can initiate malicious payloads within as little as 15 minutes after initial contact, suggesting a high level of automation and coordination. The campaign is suspected to be linked to the Black Basta ransomware group, known for its aggressive tactics and rapid exploitation of enterprise vulnerabilities.

Attack Vector and Execution Speed

The campaign exploits the ability for external users to send messages to internal Microsoft Teams accounts, a feature commonly enabled in organizations to facilitate communication with partners and vendors. Attackers create or compromise external accounts and then initiate chat sessions with targeted employees, often impersonating trusted contacts or IT support personnel. Within minutes, these chats contain links or file attachments that trigger malware downloads. The 15-minute window indicates that the attackers are either pre-positioned or using automated tooling to accelerate the delivery phase once a target engages with the message.

• External Teams chats are used as the initial access vector
• Malware is delivered via links or attachments in the chat
• Execution occurs rapidly, sometimes within 15 minutes
• Potential ties to the Black Basta ransomware operation

Who Is at Risk

Organizations that permit external access to Microsoft Teams without strict controls are the primary targets. This includes enterprises in finance, healthcare, legal, and technology sectors where collaboration with third parties is routine. Any company that allows external domains to message internal users without prior approval or multi-factor authentication is exposed. The speed of the attack means that traditional email-based phishing defenses may not provide sufficient protection, as the threat bypasses email gateways entirely and moves directly into the collaboration environment.

Defensive Measures and Immediate Actions

Security teams should take the following steps to mitigate exposure from this campaign:

• Restrict external access in Microsoft Teams to only approved domains and require explicit user consent before external messages are delivered.
• Enable advanced phishing and malware protection policies within Microsoft Defender for Office 365, including real-time scanning of Teams attachments and links.
• Deploy endpoint detection and response (EDR) solutions capable of identifying and blocking suspicious process creation and network activity triggered by Teams interactions.
• Conduct immediate user awareness training focused on recognizing social engineering attempts through collaboration platforms.
• Monitor for unusual authentication patterns or lateral movement following Teams-based initial access.

Additionally, organizations should review their conditional access policies to ensure that external communication is tightly controlled and logged.

Conclusion

The use of external Microsoft Teams chats as a rapid malware delivery mechanism represents a significant evolution in social engineering tactics. With suspected links to Black Basta, the stakes are high for organizations that rely heavily on collaborative workflows. Proactive configuration of Teams security settings, combined with robust endpoint monitoring and user education, is essential to counter this threat. For enterprises looking to strengthen their defenses, Grivyonx's AI automation and cloud security services can help detect anomalous collaboration behaviors and enforce secure access controls at scale.