What did we find?
In June 2026, eSentire's Threat Response Unit (TRU) identified a Microsoft Teams-based phishing campaign targeting a customer in the Retail industry. Threat actors first bombarded victims with email spam before posing as IT helpdesk via Microsoft Teams.
Under this pretense, they sent malicious links containing step-by-step instructions guiding victims to download, unpack, and execute a Deno-based backdoor from the command prompt that TRU is tracking as "DenoGate", named for its ability to turn compromised machines into proxies, effectively opening a gateway into the victim's network.
Initial Access
Threat actors subscribed victims' email addresses to numerous services, flooding their inboxes with spam before promptly reaching out via Microsoft Teams where they posed as IT helpdesk and instructed victims to install a "patch" to resolve the issue. The so-called patch was an archive named patch01309.txt and contained the DenoGate backdoor.
In this process, threat actors used a lookalike Office 365 tenant to impersonate the victim organization's IT helpdesk, following the format shown below (where <REDACTED> represents the victim organization's redacted company name):
- ithelpdesk@<REDACTED>company.onmicrosoft.com
Posing as IT helpdesk, threat actors sent victims Amazon S3 links to pages containing instructions to download, unpack, and execute the "patch" (the DenoGate backdoor). A partially redacted URL identified during incident analysis is shown below.
- https://<REDACTED>.s3.us-east-1.amazonaws.com/index.html?john.smith@<REDACTED>&source=teams.lnk
The figure below illustrates an example notification a user sees when receiving an incoming call from an external Microsoft Teams account.
Extraction of the "patch" revealed the deno run-time (deno.exe) and several DenoGate-affiliated JavaScript files (covered in-depth later in this blog).
Attack Chain
The attack chain begins with threat actors conducting Email Bombing attacks against victim email addresses, where victims receive large amounts of spam emails in a short period of time. This is followed by a Microsoft Teams message or call from the threat actor claiming to be part of the victim's IT helpdesk.
Victims were sent a link via Microsoft Teams and were instructed to download the "patch" file, open a command prompt, and execute a series of commands that ultimately unpacked and executed the DenoGate Backdoor.
The backdoor transmits the victim's domain name, computer name, and network information to the threat actors via WebSocket, supports further fingerprinting of the victim's network / host, and allows threat actors to use the victim's device as a proxy.
DenoGate Analysis
The DenoGate backdoor is composed of four files: the launcher (app.js), and three JavaScript files that run as local HTTP servers, and are described in the table below.
app.js (Loader)
This module serves as the entrypoint for DenoGate. It is responsible for launching the core module, "back.js" via the following command line:
back.js (C2 Communication Handler)
The figure below displays contents from the core module "back.js" and is responsible for establishing persistent communications with the CloudFront-based C2 server over websockets.
Upon establishing communications, it sends a version identifier "1.010.10.10" to the C2, followed by the victim fingerprint information: domain name, username, computer name, and a randomly generated, unique identifier.
HTTP POST requests to the local HTTP server run by this module serve to relay TCP socket responses (e.g. received from the webui.js module) back to the C2. The callback method, handleRequest, is shown in the figure below.
JSON-encoded messages from the C2 contain base64-encoded command data within the event.data attribute. The onMessage handler base64-decodes this data, parses the resulting JSON, and passes it to processCmd for processing. Attributes that can appear in this data are described in the following table.
helper.js (Command Executor)
The module "helper.js" is the command handler and runs as an HTTP server on port 10022. It provides a single endpoint "/exec" and launches Windows Command Prompt with specified arguments. This is used by the "back.js" module in collecting the victim's network information and installation/uninstallation of the persistence registry value "Deno_AutoRun".
webui.js (TCP Tunneler)
The final module, "webui.js" is the TCP socket manager and runs as an HTTP server on port 10021 like the other modules. It provides three endpoints:
- POST /connect - Opens a TCP connection via Deno.connect(), for the threat-actor specified host:port, assigns it an incrementing socket ID, stores it in the socket map, calls listenToSocket to continuously read from the connection, and returns the socket id.
- POST /send - Enables the C2 to send data through an opened TCP socket on the victim's machine. The response is relayed back to the C2 via back.js's handleRequest method, where the data is base64-encoded and sent as JSON over the WebSocket with the C2.
- POST /closesocket - Closes an existing TCP socket by id.
What did we do?
- Our team of 24/7 SOC Cyber Analysts proactively isolated the affected host to contain the infection on the customer's behalf.
- We communicated what happened with the customer and helped them with remediation efforts.
- TRU is closely monitoring campaigns involving DenoGate and developing up-to-date detection content for eSentire MDR for Endpoint, eSentire MDR for Log, and eSentire MDR for Network.
What can you learn from this TRU Positive?
- Threat actors used a social engineering approach by impersonating IT Helpdesk through Microsoft Teams after overwhelming the victim with email bombing.
- The "patch" provided to the victim contained DenoGate, a Deno-based JavaScript backdoor made up of multiple modules.
- DenoGate communicates with its C2 server over WebSockets, transmitting victim details such as domain name, username, computer name, and network information. It can also execute commands to establish persistence, and open TCP connections effectively turning the victim machine into a proxy.
- This campaign highlights how threat actors are abusing Microsoft Teams through legitimate-looking external tenants to impersonate IT support and establish trust with victims. It also shows a shift toward using less common JavaScript runtimes like Deno, rather than the more widely recognized Node.js, to make malicious activity appear less suspicious.
Recommendations from the Threat Response Unit (TRU)
- Restrict or disable external Microsoft Teams messaging from unrecognized tenants where business requirements allow. At minimum, configure Microsoft Teams to require explicit approval before accepting contacts from external organizations.
- Partner with a 24/7 multi-signal Managed Detection and Response (MDR) services provider for total attack surface visibility, 24/7 threat hunting and disruption, and rapid threat response to prevent attackers from spreading laterally through your environment.
- However, at the bare minimum, organizations should use a Next-Gen AV (NGAV) or Endpoint Detection and Response (EDR) solution to detect and contain threats.
Indicators of Compromise
The table below lists Indicators of Compromise for the DenoGate backdoor.
References
To learn how eSentire can help you find exposures and defend your organization, connect with an eSentire Security Specialist now.
GET STARTEDABOUT ESENTIRE’S THREAT RESPONSE UNIT (TRU)
The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.