“Hello, This Is IT”: Attacking Professional Service Firms Through Microsoft Teams

Accounting, consulting, and law firms share workpapers, deal files, HR records, and privileged communications with clients, regulators, and counterparties through Microsoft Teams. Firms need to be aware of the potential for a single malicious call or chat opening the door to months of undetected data theft and extortion.

A Real Incident: From Email Bombing to Extortion

In June, a professional services firm experienced a coordinated attack:

1. Email bombing as a distraction
   
   

   Numerous employees were flooded with junk emails. The firm was using an advanced email security tool and endpoint detection and response (EDR) and neither flagged anything as clearly malicious.

2. Fake “IT Help Desk” via external Teams call
   
   

   Soon after, affected staff received external Microsoft Teams calls from people claiming to be the firm’s IT Help Desk, referencing the email issue. The head of HR answered and, trusting the caller, allowed a remote-control session so “IT” could fix the problem.

3. Low and slow data theft
   
   

   The threat actor installed tools on the HR leader’s system to eavesdrop and discover resources, including the file server. Over the next two months they exfiltrated data in small, carefully timed increments, avoiding Data Loss Prevention (DLP) thresholds and EDR alerts.

4. Delayed detection and extortion
   
   

   The FBI contacted the firm in June about possible issues, but with no clear internal alerts, the firm found nothing conclusive. Only after moving to a different EDR tool and a Managed Security Service Provider (MSSP) in early August did new monitoring reveal renewed email bombing and an email containing an extortion demand tied to the stolen HR data. With highly sensitive employee information at risk of publication on a data leak site, the firm ultimately paid a significant ransom.

This entire chain of events began with a “routine” Teams call.

How Attackers Are Using Teams

• Impersonating IT or “Security” to bypass MFA
  
  

  Attackers pose as “IT” or “Microsoft support” in Teams, claiming urgent security issues. They pressure users to approve unexpected multi-factor authentication (MFA) prompts or enter codes into authenticator apps, granting full account access.

• Fake help desk and remote-control scams
  
  

  Ransomware operators use Teams messages or calls to start remote sessions, install “support” tools, then move laterally into document, HR, and matter systems.

• Malicious “client documents” in Teams
  
  

  Seemingly normal files (e.g., “Updated trial balance – FINAL.xlsx”) are used to deliver loaders and backdoors.

• Abusing external and guest access
  
  

  Broad guest/external access lets attackers masquerade as clients or vendors, silently joining Teams, observing discussions, and downloading documents.

A Practical Teams Security Baseline

To prevent a similar incident, firms should treat Teams as a high risk, high value system and implement a hardened baseline across identity, collaboration, and network layers.

• Governance and Access
  
  
  • Clear ownership for Teams security (CISO/IT Security).
  • MFA for all users; phishing resistant methods (e.g., security keys) for partners, leaders, and admins.
  • Conditional Access (e.g., stronger requirements for sensitive teams; block risky sign ins).
  • Admin/privileged roles tightly limited, monitored, and timebound.
    
    
• External Collaboration and Guests
  
  
  • Restrict external access to approved domains.
  • Allow guests only with a defined business need and internal sponsor; review and remove regularly.
  • Block or tightly control direct Teams calls from external parties, especially to help desk or high value users – this would likely have stopped the fake IT call in the case above.
    
    
• Configuration, Apps, and Data Protection
  
  
  • Standardized team templates with predefined channels, permissions, and approved apps.
  • Only allow third party apps from an approved, security reviewed list.
  • Apply sensitivity labels and DLP policies to Teams content, especially HR, finance, and privileged matters while recognizing that “low and slow” exfiltration requires complementary controls.
    
    
• Network and Protocol Hardening
  
  Disable legacy protocols and weak settings that attackers use for local discovery and lateral movement:
  
  
  • LLMNR (Link-Local Multicast Name Resolution)
  • NBTNS (NetBIOS Name Service)
  • mDNS (Multicast Domain Name System)
  • RC4 cipher usage
  • “Allow Reversible Password Encryption”
    
    
  A standard hardened secure configuration would typically disable these by default, removing key tools the attacker used in the incident.
  
  
• Monitoring, Response, and User Awareness
  
  
  • Integrate Teams and identity logs into SIEM (Security Information and Event Management) and XDR (Extended Detection and Response); monitor external calls and remote sessions.
    
    
  • Alert on:
    
    • External users posing as “IT/Support”
    • Unusual external sharing or access to HR/finance repositories
    • New high privilege apps or admin actions
      
      
  • Maintain incident response playbooks for Teams based attacks, including impacts on confidentiality, privilege, and HR data.
    
    
  • Train users to:
    
    • Never share MFA codes or approve prompts they didn’t initiate.
    • Never start remote control sessions based solely on a Teams message/call.
    • Always verify unexpected IT requests via known help desk numbers or ticketing systems.
      
      
  A standard hardened secure configuration would typically disable these by default, removing key tools the attacker used in the incident.

What This Means for Your Firm

Teams is central to how professional services firms deliver work and maintain client trust.

The incident shows that:

• A believable Teams call can bypass multiple technical controls.
• A single high value user can be a gateway to devastating exposure.
• Low volume exfiltration can evade traditional DLP and endpoint tools for months.
  
  

By hardening Teams, tightening external interaction, disabling legacy protocols, strengthening monitoring, and training users to distrust unsolicited “IT” outreach, firms can dramatically reduce the chance that one “Hello, this is IT” Teams call becomes the first step in a major breach or ransomware event.

Contact

The Professional Services Practice at Aon values your feedback. To discuss any of the topics raised in this insight, please contact Allan Vogel or Philip Kibler.


Allan Vogel
Managing Director, CyQu Advisory Practice Leader





Philip Kibler
Senior Vice President, CyQu Advisory
Montreal