Microsoft Teams Exploited to Deliver Matanbuchus Ransomware Payload

A sophisticated cyberattack campaign has emerged targeting organizations through Microsoft Teams impersonation, delivering the updated Matanbuchus 3.0 malware loader that serves as a precursor to ransomware deployment.

Security researchers at Morphisec have identified instances where attackers successfully compromised systems by impersonating IT helpdesk personnel during external Teams calls, ultimately leading to the execution of malicious scripts that deployed the advanced malware loader.

The attack methodology involves social engineering tactics where cybercriminals contact victims through Microsoft Teams, presenting themselves as legitimate IT support staff.

During these fraudulent interactions, attackers guide unsuspecting employees to activate Quick Assist and execute PowerShell scripts that initiate the malware deployment process.

This technique represents a significant evolution in attack vectors, leveraging the trust associated with familiar business communication platforms to bypass traditional security measures.

Enhanced Malware-as-a-Service Platform

Matanbuchus has evolved significantly since its initial deployment in 2021, now operating as a sophisticated Malware-as-a-Service platform with the recently released version 3.0 commanding prices of $10,000 for HTTP variants and $15,000 for DNS variants on underground markets.

The malware’s primary function involves establishing initial system compromise and facilitating the deployment of secondary payloads, including ransomware, making it a critical component in multi-stage attack chains.

The updated version incorporates advanced obfuscation techniques utilizing Salsa20 encryption with 256-bit keys, replacing the previously used RC4 algorithm.

This enhancement significantly improves the malware’s ability to evade detection while maintaining communication with command and control servers.

The loader now employs MurmurHash3 algorithms for API resolution, demonstrating the developers’ commitment to staying ahead of security detection mechanisms.

Persistence mechanisms have been substantially refined, with the malware now creating scheduled tasks through sophisticated COM manipulation and shellcode injection techniques.

The loader generates unique identifiers based on system volume serial numbers and establishes registry entries that enable continuous communication with command and control infrastructure.

This persistence strategy ensures the malware can maintain its foothold on compromised systems even after system reboots or security scans.

Advanced Technical Capabilities

The malware demonstrates sophisticated system reconnaissance capabilities, collecting extensive information about the compromised environment including security controls, system configurations, and installed applications.

Matanbuchus 3.0 specifically identifies the presence of major endpoint detection and response solutions including Windows Defender, CrowdStrike Falcon, SentinelOne, Sophos EDR, Trellix, Cortex XDR, BitDefender GravityZone EDR, ESET Enterprise Inspector, and Symantec Endpoint Detection and Response.

This intelligence gathering enables the malware to adapt its execution strategies based on the security stack present on the target system.

The loader can execute various payload types including MSI installers, DLL files, executables, and shellcode, with support for both direct execution and process hollowing techniques.

The malware impersonates legitimate applications such as Skype Desktop (version 8.69.0.77) to blend with normal network traffic during command and control communications.

Command execution capabilities include direct CMD and PowerShell command execution, WQL query support for system information gathering, and the ability to install MSI packages with administrative privileges.

The loader utilizes indirect system calls to evade detection by security solutions that monitor direct API calls, demonstrating advanced evasion techniques typically associated with state-sponsored malware.

The delivery mechanism involves cybersquatting techniques, utilizing domains such as notepad-plus-plu[.]org (missing the ‘s’ from the legitimate notepad-plus-plus.org) to host malicious update packages.

These packages contain legitimate Notepad++ updater components alongside malicious DLL files that sideload the Matanbuchus payload.

The attack chain begins with PowerShell scripts that download and execute these packages, establishing the initial compromise vector that enables further malicious activity.

Indicators of Compromise (IOCs)

Hash/URL	Description
94.159.113[.]33 – fixuplink[.]com [RU]	Command and Control Server
bretux[.]com	Malicious Domain
nicewk[.]com	Command and Control Domain
emorista[.]org	Malicious Domain
notepad-plus-plu[.]org	Malicious Update Location
da9585d578f367cd6cd4b0e6821e67ff02eab731ae78593ab69674f649514872	libcurl.dll (SHA256)
2ee3a202233625cdcdec9f687d74271ac0f9cb5877c96cf08cf1ae88087bec2e	libcurl.dll (SHA256)
19fb41244558f3a7d469b79b9d91cd7d321b6c82d1660738256ecf39fe3c8421	libcurl.dll (SHA256)
211cea7a5fe12205fee4e72837279409ace663567c5b8c36828a3818aabef456	libcurl.dll (SHA256)
0f41536cd9982a5c1d6993fac8cd5eb4e7f8304627f2019a17e1aa283ac3f47c	libcurl.dll (SHA256)
EventLogBackupTask	Scheduled Task Name

Get Free Ultimate SOC Requirements Checklist Before you build, buy, or switch your SOC for 2025 - Download Now