Fake help desks, exploited VPNs and a hack the business missed

Security firm Arctic Wolf Labs has documented hundreds of real cases of the same attack, and each one reaches staff through Microsoft Teams.

It starts with a flood. A staff member's inbox fills with hundreds of newsletter and subscription confirmations in a few minutes. Soon after, a Teams chat arrives from "Help Desk" or "IT Support", sometimes with the company's own name added, offering to sort it out.

On a call, the attacker talks the person into opening a legitimate remote access tool such as Quick Assist or AnyDesk. They then install a backdoor, work their way towards the servers that run the network, copy data and deploy ransomware. Sophos has linked the campaign to the Chaos ransomware group.

Chaos first appeared in February 2025, and researchers at Cisco Talos believe it is likely made up of former members of an earlier gang, BlackSuit. It copies a company's data before locking its systems, so it can demand payment to unlock them and to keep the data private.

No software flaw is involved. Arctic Wolf says the approach "exploits trust rather than a software vulnerability", and it only works where Teams accepts chats from outside organisations.

Separate research from Huntress shows how far a stolen Microsoft 365 session can go. Between July and September, attackers replayed stolen sign-in tokens to get into 97 accounts at 79 organisations. They then added their own authenticator apps and set hidden inbox rules to bury payroll and bonus emails.

Attackers have found a way to cut off a business's remote workers all at once, without needing a password.

Staff who work from home or on the road usually reach company systems through a VPN, a secure connection into the office network. To do its job, a VPN has to be reachable from the internet, which also makes it one of the first places attackers look for a way in.

The Cisco flaw, CVE-2026-76418, affects the remote access VPN on Cisco's Secure Firewall ASA and FTD software. An attacker doesn't need to log in to force the device to restart, which drops every remote connection. Devices are exposed when a setting called secondary authentication is turned on. Cisco learnt in October that attackers were already using the flaw, and it has released a fix.

Ivanti Connect Secure, another VPN used by many organisations, has a more serious problem. CISA, the US government's cyber security agency, has confirmed attackers are using two more flaws in it. Combined with a third flaw, they let an attacker take full control of the device without a password. Volexity, the security firm that investigated the attacks, says the attacker then extracted credentials and searched for administrator passwords and BitLocker recovery keys, the keys that unlock encrypted laptops. Ivanti has fixed the flaws in versions 25.1.1.3 and 22.8R2.6.

The Australian Signals Directorate has described two recent operations against cyber criminals. And they should concern every board.

The first targeted Amadey, malicious software that quietly steals logins and personal details from infected computers so criminals can sell them on the dark web. It spreads hidden inside free software. In one case, ASD found it in a free, illegitimate copy of Photoshop.

The Amadey network had access to 180,000 computers worldwide, including in Australia. ASD got into its back end and cut the criminals off from them.

In the second operation, ASD was tipped off that 5 terabytes of data stolen from a business was for sale. The business didn't know it had been hacked. ASD got in and destroyed the data before it could be sold.

Tauri Gregory, ASD's acting deputy director-general of intelligence, told the ABC the agency believes about 4.8 million files stolen from Australians were destroyed.