Increase in Email Bombing and IT Impersonation Campaigns

THE THREAT

Since early 2026, eSentire has observed an increase in Microsoft Teams-based phishing, where threat actors impersonate IT Support and Helpdesk teams, to trick users into granting remote access to their devices. These phishing attacks have often been linked to email bombing, followed by threat actors reaching out to users under the guise of providing assistance to resolve an issue. The objective of the attack is to trick the user into granting remote access to their device, and once obtained, threat actors will attempt to exfiltrate data and execute additional payloads to establish persistence or deploy ransomware.

What we're doing about it

• IP addresses associated with real-world attacks are blocked via the eSentire Global Block List available to eSentire MDR for Network customers
• Indicators of Compromise (IoCs) have been added to the Threat Intelligence Feed and are available for Threat Feed subscribers
• eSentire MDR for Log has detections in place to identify Microsoft Teams messages originating from external accounts from high-risk sources
• eSentire MDR for Endpoint has detections in place to identify domain reconnaissance, application control bypass attempts, as well as for malware and ransomware being deployed on an endpoint
  • Specific detections relating to WinSCP abuse have been created within eSentire MDR for Endpoint in response to recent attacks
• eSentire's Threat Response Unit (TRU) discussed voice phishing (vishing) attacks leading to Remote Monitoring and Management (RMM) tool abuse in the March 2026 TRU Intelligence Briefing
• The eSentire Threat Intelligence team is actively tracking this topic for additional details and detection opportunities

What you should do about it

• Microsoft Teams messages and calls from external organizations should be restricted unless necessary
  • If required, restrictions should be placed to only allow messages and calls from trusted business partners
  • External collaboration policies should be reviewed to provide external sender notifications when interacting with external users
• Remote Access tools (e.g. Quick Assist, AnyDesk, ConnectWise) should be restricted via policy, unless required for normal operations
  • File Transfer Utilities (e.g. WinSCP, RClone, FileZilla, MegaSync) should be restricted via policy, unless required for normal operations
• eSentire MDR for Log customers should ensure that Office 365 Audit Logs are being ingested
• User Awareness Training should be conducted to educate users on these attacks and what to look out for
  • Employees should also be educated on standard internal processes for escalating internal issues
  • Create processes for users to verify any unexpected IT request through a secondary, trusted channel, such as calling the official helpdesk number, emailing them directly, or using an internal ticketing system

Additional information

Microsoft Teams-based phishing and IT Support/ helpdesk impersonation attacks are known to follow a similar pattern for gaining initial access. Threat actors will abuse enterprise collaboration workflows to contact users directly over Microsoft Teams, impersonating an organization's IT Support team. The goal of these phishing attacks is to trick users into granting remote access through Remote Monitoring and Management (RMM) tools. This technique has been widely reported on, and utilized by various groups including Scattered Spider, Payouts King, and UNC6692. Attack patterns differ following initial access, and depend on the threat actors' objectives, ranging from payload deployment, such as malware or ransomware, to data theft.

eSentire has recently observed several intrusion cases which resulted in data exfiltration, where the activity was traced back to IT Support impersonation via Microsoft Teams. In these attacks, the threat actors tricked the users into granting access via Quick Assist or AnyDesk. Once this access was gained, the attackers downloaded portable versions of WinSCP from its official website and utilized the tool to exfiltrate data from the compromised hosts. In another instance, threat actors used Quick Assist to download a malicious ZIP archive file onto the host (Email-Deployment-Process-System.zip) that contained a Java binary, which was used to execute a malicious Java application, and was followed by data exfiltration.

Instances of Microsoft Teams-based phishing observed by eSentire across our customer base reveal several consistent infrastructure and sender patterns. The majority of malicious Teams messages originate from bulletproof hosting providers, including NKtelecom INC, WorkTitans B.V., Global Connectivity Solutions LLP, and GWY IT PTY LTD, with single IP addresses observed targeting multiple organizations simultaneously indicating coordinated, infrastructure-backed operations rather than opportunistic attacks. Threat actors are leveraging two primary sender domain strategies: freshly created .onmicrosoft.com tenants with IT-operations-themed display names (e.g., "IT Protection Department," "Windows Security Help Desk"), and disposable .top TLD domains registered specifically for these campaigns. A notable social engineering evolution has also been observed, where threat actors are increasingly pairing realistic English full-name personas (e.g., michaelturner@, danielfoster@) with IT-themed tenant names, rather than using generic role-based accounts such as helpdesk@ or admin@, likely to increase perceived legitimacy of the contact.

eSentire's 2026 Annual Cyber Threat Report identified a large increase in email bombing and IT Impersonation attacks between 2024 and 2025, while noting a 72% success rate in the identified attacks. Based on the increase in observed activity and high success rates of the technique, eSentire's Threat Intelligence team assesses with high confidence that email bombing and IT impersonation attacks will continue to be prevalent throughout the remainder of 2026.

References:
[1] https://www.esentire.com/security-advisories/ongoing-email-bombing-campaigns-leading-to-remote-access-and-post-exploitation
[2] https://www.esentire.com/what-we-do/threat-response-unit/threat-intelligence-services
[3] https://www.esentire.com/resources/library/march-2026-tru-intelligence-briefing-on-demand
[4] https://learn.microsoft.com/en-us/microsoftteams/trusted-organizations-external-meetings-chat?tabs=organization-settings
[5] https://www.microsoft.com/en-us/security/blog/2026/04/18/crosstenant-helpdesk-impersonation-data-exfiltration-human-operated-intrusion-playbook/
[6] https://blogs.chapman.edu/information-systems/2025/09/02/scattered-spider-email-bombing-a-ruthless-hackers-playbook/
[7] https://www.zscaler.com/blogs/security-research/payouts-king-takes-aim-ransomware-throne
[8] https://cloud.google.com/blog/topics/threat-intelligence/unc6692-social-engineering-custom-malware
[9] https://www.esentire.com/blog/key-statistics-esentire-2026-annual-cyber-threat-report