The most dangerous "IT support" message your plant engineers will receive this quarter will not come from your help desk. It will arrive in Microsoft Teams from an external tenant, sometimes right after their inbox is flooded with hundreds of spam emails, and it will offer to fix exactly that problem. 

This is not a Teams vulnerability. It is a trust attack, and it is now documented at scale. On October 26, 2026, Arctic Wolf Labs reported a recurring pattern across more than 400 incidents in which attackers used Teams external chat to pose as internal IT. For manufacturers, who sit at the centre of the industrial ransomware problem, this is the front door worth closing first. 

Key takeaways for security leaders 

• Scale: Arctic Wolf analysed 400+ incidents of Teams external-chat abuse, reported on October 26, 2026. 

• Speed: Attackers can reach payload execution in under 15 minutes after a victim engages. In one Sophos-investigated case, under 17 hours passed between the first Teams contact and Chaos ransomware deployment. 

• Root cause: External access (federation) is on by default. No exploit is needed. 

• Targeting: ReliaQuest found 77% of Black Basta-style incidents between March 1 and April 1, 2026 targeted senior staff, and manufacturing was among the two most affected sectors. 

• The fix is mostly configuration: an external-domain allow-list, Quick Assist and RMM control, and out-of-band verification stop most of this chain. 

• OT angle: a compromised office laptop with domain reach is the usual first step toward plant disruption, even when no one ever touches a PLC. 

What has changed in 2026: the latest developments 

The technique is not new. Microsoft first documented Quick Assist abuse by Storm-1811 in 2024. What is new is the volume, the number of crews copying the playbook, and how industrialised the infrastructure has become. Newest first: 

Four shifts worth briefing your board on 

1. The crews have multiplied. Sophos separately tracks STAC4749 (Chaos), and earlier clusters STAC5777 and STAC5143 that copy the Storm-1811 playbook. Arctic Wolf also ties the technique to Cactus, 3AM and GoGRPC activity. Microsoft's September write-up does not name a single actor, and TechRadar notes that many groups now use it. 

2. Black Basta is gone, its playbook is not. The group went defunct after its internal chats leaked, yet ReliaQuest says it assesses with high confidence this is a unified campaign by former affiliates, not independent copycats. Attribution varies by vendor, so treat names as hypotheses and defend against the behaviour. 

3. Infrastructure is professionalising. Sophos observed IT-themed .top domains, and Arctic Wolf saw the same shift. Arctic Wolf also counted roughly 100+ emoji-decorated display names and speculates AI is generating identities at scale. 

4. Tool choice adapts to your blocklist. Sophos reports STAC4749 preferred Quick Assist, then moved mainly to the cloud-based RemSupp tool from April, possibly because it appears on fewer corporate blocklists. Blocking one tool is not a strategy.

Anatomy of a fake IT support intrusion 

Across Microsoft's, Arctic Wolf's and Sophos's reporting, the chain is consistent enough to describe as one playbook. The nine stages below combine their findings. 

1. Pressure. In many cases the victim's inbox is flooded with hundreds of newsletter and subscription confirmations within minutes. The goal is urgency, and to bury real security alerts. 

2. External Teams contact. A one-to-one chat arrives from a throwaway or paid tenant. Display names such as "IT Support (Internal)" or "IT Service Desk (Matthew)" are designed so the label reads internal while Teams simultaneously shows External. Microsoft logs this first contact as a ChatCreated event. 

3. Vishing, sometimes. A Teams call follows. Sophos saw calls from 90 seconds to over 20 minutes, with most lasting roughly two to two-and-a-half minutes. Voice keeps malicious instructions out of chat logs. 

4. Remote access. The victim is guided to open Quick Assist and read back a code, approve a Teams control request, or install another RMM tool. Arctic Wolf lists Quick Assist, AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport and LogMeIn as the tools it saw most. 

5. Payload. PowerShell pulls an MSI from cloud storage, often disguised with update-style names. Microsoft saw a silent install that stages a portable Node.js runtime and an encrypted JavaScript implant under the user's profile. 

6. Persistence. Microsoft observed per-user Run keys or Startup shortcuts named EdgeUpdate. Sophos saw registry entries disguised as Realtek audio components. 

7. Reconnaissance. ADSI queries enumerate domain accounts, servers and user description fields. Periodic screenshots are captured. 

8. Lateral movement. WinRM on TCP 5985 reaches file servers, database servers, domain controllers and certificate authorities. 

9. Impact. A second RMM tool for redundancy, data theft, then ransomware. As summarised by The Hacker News, observed intrusions include lateral movement to domain controllers and Level as a backup RMM before data exfiltration and the ransomware binary, and payloads such as the GoGRPC backdoor. 

Why it slips past defences 

Three properties make this hard for conventional tooling: 

• No malicious link in the chat. Arctic Wolf notes attackers generally avoid pasting URLs into Teams, which would trigger Safe Links and ZAP scanning. They browse to the payload themselves during the remote session, so message scanning alone is not enough. 

• Signed, legitimate tools do the work. Quick Assist is built into Windows and signed by Microsoft. A Node.js runtime fetched from the official distribution is not unsigned malware. 

• The user does the dangerous step. Microsoft stresses that Teams already shows external-tenant labels and Accept/Block prompts. The attack depends on persuading the user to override them. 

The PhishLocker module is a good illustration of attacker creativity. Per the Cyber Security News write-up of Expel's findings, it shows a convincing fake Windows lock screen and captures the password in plaintext. In the SynkLoader case the fake screen was a borderless window, so the task switcher could still appear over it, which is a useful tell for user training.

Why manufacturing and OT environments are exposed 

Manufacturers are not an incidental victim set. They show up near the top of nearly every dataset on this technique and on industrial ransomware generally. 

• Industrial ransomware volume: Dragos counted 1,140 ransomware incidents involving industrial organisations in Q2 2026, up 12% from 1,020 in Q1, with manufacturing accounting for 747 of them (65%). 

• Teams-specific targeting: ReliaQuest reports manufacturing and professional, scientific and technical services each made up 26% of Black Basta-style incidents it observed in 2026. Sophos lists manufacturing among the largest affected sectors in the STAC4749 campaign. 

• A related lure, same sector: Check Point found a Teams guest-invitation campaign that sent fake billing alerts from legitimate Microsoft addresses, with 27% of the emails aimed at manufacturing, engineering and construction. 

• Broader trend: SecurityWeek reports attacks on manufacturers were 40% higher in early 2026 than the same period a year earlier. 

The IT-to-OT question CISOs should ask 

The same Dragos report notes it saw no Q2 case where a ransomware operator reached Stage 2 of the ICS Cyber Kill Chain or directly manipulated a control system. That is reassuring, but it does not mean production is safe. Dragos' point, as relayed by Help Net Security, is that ransomware can interrupt production by disrupting enterprise IT even with no evidence of control-system access. 

The Jaguar Land Rover shutdown shows how that plays out. Per SecurityWeek, it shut down its UK plants during September 2025, halting production of around 1,000 vehicles a day and affecting more than 5,000 other companies. 

Our analysis: Microsoft's September findings matter for OT owners for one specific reason. The operators it observed reached domain controllers and certificate authorities. In many plants, the identity services that IT shares with OT (Active Directory, certificate services, jump hosts, remote-access gateways) are exactly what engineers rely on to reach production networks. A fake help desk call to a single office employee can become a question about who controls identity for the plant. 

Three factors raise the stakes in industrial settings: 

1. Shared identity. If OT jump servers authenticate against the corporate domain, a domain-level compromise is also an OT access problem. 

2. Engineers are used to remote support. Vendor and integrator remote sessions are routine in industrial environments, so a screen-share request does not feel unusual. 

3. Third parties hold access. Engineering firms, integrators and equipment makers are themselves heavily hit, as the Dragos numbers show. A compromised partner can reach you through a trusted channel. 

Detection and defence: closing the chain at every stage 

Vendors agree on the shape of the fix. Arctic Wolf puts it plainly: most organisations have no legitimate need for open, any-tenant external chat. The controls below follow guidance from Microsoft and Arctic Wolf. 

Prevent: controls to put in place first 

Detect: signals worth alerting on 

Arctic Wolf says most of its alerts fire at the ChatCreated stage, before the user has done anything. That is your best window. Microsoft also publishes advanced hunting queries for external Teams chat creation and the later stages. 

• An external one-to-one Teams chat from a tenant seen for the first time, especially with an IT-themed display name or domain. 

• An email flood followed within minutes by an external "help desk" contact to the same user. 

• A remote-assist process tree followed immediately by cmd.exe or PowerShell on the same desktop. 

• PowerShell started from explorer.exe that writes an MSI to Downloads, AppData or Temp. 

• node.exe, or a renamed copy, running a loader from AppData\Local. 

• Any RMM tool that IT did not deploy, followed by user, group or network enumeration. 

• WinRM connections from non-administrative processes to domain controllers or certificate authorities.

Respond: assume the host is the way in 

Microsoft's advice for anyone who finds these indicators is to assume the operator gained network-level access through the compromised host, and to rotate credentials reachable from that machine, including domain admin accounts if the device was domain-joined. Arctic Wolf adds a practical warning: a second RMM channel often survives clean-up of the first implant, so hunt for it. 

Training that matches the real attack 

Generic phishing training misses this one, because the message arrives inside a trusted tool. Based on both vendors' advice, teach staff three things: 

• Real IT contacts you through named channels and approved domains. Publish which ones. 

• Read the External tag and the real sender domain. "(Internal)" in a display name is not evidence. 

• Never read back a remote-assist code, approve screen control, or type a password into an unexpected lock screen without calling IT on a known number. 

Microsoft has also added end-user reporting for security inside Teams, so staff can report a suspicious message or external user in a couple of clicks. 

A 90-day plan for industrial organisations 

The vendor guidance above is written for enterprise IT. For plant operators, the order of work matters. This sequence is our recommendation, not a vendor standard. 

1. Days 1–14, shut the front door. Move Teams external access to an allow-list, block trial tenants and unmanaged accounts, and restrict Quick Assist to named IT roles. These are tenant settings, not projects. 

2. Days 15–45, control the remote-access path. Inventory every remote-support and RMM tool in use, including those your integrators install. Allow-list the approved ones in endpoint control. Publish a callback-verification procedure for the help desk. 

3. Days 30–60, protect identity. Review which domain accounts, certificate services and jump hosts the plant depends on. Limit WinRM to management hosts. Require phishing-resistant MFA for staff with OT access. 

4. Days 45–90, test the response. Run a tabletop where an engineer approves a fake support session. Decide in advance who isolates the host, who rotates credentials, and who decides whether to separate IT from OT. 

If you do one thing this week, check your Teams external access setting. If it still says "allow all external domains", you are in the population these 400+ incidents describe. 

Where Shieldworkz fits 

Shieldworkz is an end-to-end industrial OT cybersecurity company covering SCADA, OT and IoT, with services, platform and solutions delivered together for critical infrastructure and manufacturing. Collaboration-tool social engineering sits where IT security ends and OT risk begins, which is where that combined approach matters most. 

The practical questions this campaign raises are the ones an OT-focused partner can help answer: which identities and remote-access paths from the corporate network reach production, how segmented those paths really are, how quickly an anomalous remote session would be noticed, and whether the plant could keep running if IT went dark. 

Frequently asked questions 

Is this a vulnerability in Microsoft Teams? No. Both Microsoft and Arctic Wolf state the activity abuses legitimate external-collaboration features and persuades users to override warnings, rather than exploiting a software flaw. 

Which ransomware families are linked to Teams vishing? Black Basta (via Storm-1811), Cactus, 3AM and Chaos have all been tied to the technique, according to Arctic Wolf and Sophos. Black Basta's operation went defunct, but ReliaQuest links current activity to former affiliates. 

How fast do these attacks move? Arctic Wolf reports payload execution in under 15 minutes after a victim engages. Sophos saw one case with under 17 hours from first Teams contact to ransomware. 

What is the single most effective control? Restricting external Teams access to an allow-list of known partner domains, combined with a mandatory out-of-band check before any remote-access session. 

Does this threaten operational technology directly? Dragos saw no Q2 2026 case of ransomware operators manipulating a control system, but ransomware on enterprise IT can still halt production, and identity and remote-access paths link the two.