THREAT SPOTLIGHT: HIJACKED AND HIDDEN: NEW BACKDOOR AND PERSISTENCE TECHNIQUE

Summary from the TLDR InfoSec newsletter

ReliaQuest discovered a sophisticated attack chain in March 2025 that targeted finance and professional services sectors. It begins with Microsoft Teams phishing but evolves into a novel persistence technique that involves Component Object Model Type Library hijacking. The attack deploys previously unseen malware with a PowerShell backdoor that uses Telegram for command and control, showing similarities to earlier campaigns attributed to the "Storm-1811" threat group known for deploying Black Basta ransomware. To defend against these tactics, organizations should restrict external Microsoft Teams communications, block specific domains at the network edge, and implement various Windows security hardening measures.