Executive Summary
The persuasive step in this intrusion was not an email — it was a phone call inside Microsoft Teams. Unit 42 analyzed a late-June 2026 campaign that began with a forgettable "Employee Survey" message and a PDF titled "EE Survey – How to log on.pdf," then pivoted into the collaboration platform. Shortly after the victim opened the PDF, an external account displaying as "System Administrator" placed a one-on-one Teams call. Teams tagged it "External unfamiliar." The operator used Teams' own screen-control feature to take the desktop and drive it in front of the user.
From there the chain avoided every control tuned for email. The operator walked the user through installing two remote-management tools, HopToDesk and AnyDesk, then opened a command prompt and used `curl` to pull a `v7.msi` loader from an attacker-controlled domain. The MSI staged a legitimate Node.js runtime and an obfuscated JavaScript loader that delivered EtherRAT, a remote-access trojan that resolves its live command-and-control address from an Ethereum smart contract with a hardcoded web fallback. No attachment was scanned, no credential form was submitted, and no software vulnerability was exploited. The trust granted to a Teams call from a directory the organization federates with was the whole attack surface.
AttackAttack Overview
The email is the opener, not the payload. The "Employee Survey" HTML message and its PDF exist to prime the user and to time the follow-up: the PDF's on-screen instruction ("how to log on") sets the expectation that IT will be in touch. The decisive move is the inbound Teams call from an external Microsoft 365 tenant, presenting as "System Administrator." Because many organizations leave Teams federation open, an external tenant can initiate chat and calls with internal users by default, and the display name is attacker-controlled.
Once the user accepts, the operator escalates from conversation to control. Teams supports granting screen-sharing with control to the other party; artifacts recovered from the victim session — including a virtual-cursor handle Unit 42 documented as `CtrlVirtualCursorWin_000001E8A159B970` — confirm the operator obtained remote control through the screen-control feature and actively moved the pointer. With hands on the desktop, the operator no longer needs the user to make a mistake; it needs only that the user not intervene.
The staging is deliberately mundane. The operator directs installation of HopToDesk and AnyDesk to establish remote access that outlives the Teams call, then drops to a command prompt and runs `curl` to retrieve `v7.msi` from `camorreado[.]click`. Using a signed, familiar utility to fetch an installer from the console keeps the sequence within the visual vocabulary of legitimate IT support, which is exactly the disguise the "System Administrator" pretext established.
AttackInfrastructure & Tradecraft
The loader is built for stealth through legitimacy. The `v7.msi` package is not a simple dropper: during installation a CustomAction launches a headless command host that runs a batch script, which stages a legitimate Node.js runtime (v18.20.5), renames the runtime directory, and invokes an obfuscated JavaScript loader. Running attacker code as script under a genuine Node.js binary blends with development activity and sidesteps controls that watch for unusual PE execution. The loader itself layers encoding — an initial hex-encoded blob decrypted with a subtraction cipher using a 24-byte key — before delivering the final stage.
EtherRAT's command-and-control resolution is the campaign's most distinctive tradecraft. Rather than hardcoding a domain that a takedown can sever, the RAT reads its active C2 endpoint from an Ethereum smart contract (`0x6e044e19000487c4a6e6af15b4132a5561b5ee1f`), with a hardcoded fallback to `necropatia[.]com`. Pulling the current C2 from a blockchain read gives the operator a censorship-resistant, low-cost way to rotate infrastructure: defenders cannot easily seize or sinkhole a contract value, and the lookup traffic can resemble ordinary API calls. Persistence is comparatively ordinary — a Run key written as `Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSetup`, borrowing a trusted name. The staging domain `camorreado[.]click` was left as an open directory hosting multiple EtherRAT builds (v1 through v9), last updated June 26, 2026, indicating an actively iterated toolset rather than a one-off.
DetectionDetection Opportunities
The highest-fidelity signal is the cross-tenant Teams interaction, because it is generated before any malware touches disk. Teams audit and sign-in telemetry records external participants; an inbound one-on-one call or chat from an unmanaged or unfamiliar external tenant — Microsoft surfaces these as "External unfamiliar" — directed at a non-executive user is worth treating as an investigable event on its own, especially when the display name asserts an IT or administrative role. Correlate that external interaction with a screen-control grant in the same session; the combination of "external unfamiliar caller" plus "remote control of the desktop" has almost no legitimate business analogue.
On the endpoint, the staging sequence is observable even though the payload is obfuscated. Watch for a freshly installed remote-management tool (HopToDesk, AnyDesk, and their kin) shortly after a Teams session, for `curl.exe` or `msiexec.exe` retrieving or executing an MSI from an uncategorized domain, and for a `node.exe` process launched from a renamed or unusual runtime directory running script from a non-developer user context. Any of these in isolation is weak; chained within minutes of an external Teams call, they describe this intrusion.
// Endpoint half of the chain: an MSI or curl-fetched installer executing
// shortly after RMM installation, then Node.js running script from an
// unusual path. Correlate with Teams external-call telemetry for the full
// picture; the payload is obfuscated, so anchor on the staging behavior.
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "curl.exe" and ProcessCommandLine has ".msi")
or (FileName =~ "msiexec.exe" and ProcessCommandLine has_any ("http", "\\Downloads\\", "\\Temp\\"))
or (FileName =~ "node.exe" and InitiatingProcessFileName in~ ("cmd.exe","powershell.exe")
and ProcessCommandLine has_any (".js", "loader"))
| project Timestamp, DeviceName, AccountName, FileName,
ProcessCommandLine, InitiatingProcessFileNameValidationValidation Workflow
Confirm you can actually see the Teams side before relying on it. In an authorized tenant, verify that external-access events — chat and call initiation from federated and unmanaged external accounts — reach your SIEM with the external tenant identifier and the "external" classification intact. A detection that assumes Teams external-call telemetry you are not collecting is a control on paper only. Then test the current federation posture: from a separate test tenant, attempt to initiate a one-on-one chat and call with an internal test user, and confirm the result matches policy — blocked, allowlisted, or logged as expected.
On the endpoint side, in a lab, exercise the benign shape of the staging chain: install an RMM agent, fetch a harmless MSI with `curl`, and run a trivial script under a renamed Node.js runtime, then confirm your detections fire and the events join to the originating session on a common timeline. Keep this to test tenants, test users, and lab hosts — the goal is to prove that the external-call-to-remote-control-to-RMM sequence is visible and alertable, not to reproduce a working intrusion.
GapsEvasion & Gaps
The chain is engineered to fall outside email-centric defenses at every step. There is no malicious attachment to detonate, no credential-harvesting page to fingerprint, and no CVE to patch. The delivery utility (`curl`) and the runtime (Node.js) are legitimate and signed. The final C2 is resolved from a blockchain read that resists takedown and can hide in ordinary-looking API traffic, and persistence borrows the `OneDriveSetup` name to survive a cursory autoruns review. Per-build iteration on the open directory means payload hashes are perishable.
The gap defenders can close is organizational as much as technical. Teams external access is frequently owned by collaboration or messaging administrators and left permissive for business convenience, while the security team instruments email heavily and Teams lightly. That split leaves the initial, highest-fidelity event — an unfamiliar external tenant calling an employee and then taking control of the screen — under-collected. The endpoint activity is catchable, but by the time it fires the operator already has interactive control; the external-call signal is the one that fires first.
Defensive Recommendations
Constrain the channel. Restrict Teams federation from open to an allowlist of trusted external domains, and disable the setting that permits contact from Teams accounts not managed by an organization. Where full lockdown is not viable, ensure external interactions are logged and reviewable, and give users a one-click way to report a suspicious external chat or call. These controls remove or narrow the exact vector this campaign relied on rather than trying to catch its payload after the fact.
Instrument Teams like an inbox and rehearse the pretext. Route external-access and screen-control telemetry into detection, and alert when an external unfamiliar call is followed by a remote-control grant or a newly installed remote-access tool. On the endpoint, constrain who may install RMM software and from where, and monitor for signed utilities fetching installers from uncategorized domains and for Node.js executing script outside developer contexts. Finally, brief users on this specific script: real internal IT does not cold-call through Teams from an outside tenant and ask to take control of the machine — and if a "System Administrator" does, the right response is to end the call and report it.