EtherRAT Malware Spreading via Microsoft Teams Through Fake IT Support Calls

Cybercriminals have recently developed a highly creative social engineering tactic to breach corporate networks. Threat actors make voice calls via Microsoft Teams, impersonating the IT department employees of the targeted organizations. Convincing employees that they are corporate technical support personnel, the attackers aim to trick them into downloading a malicious software. This method goes beyond traditional email-based phishing attacks by establishing direct communication. The main goal of the attack is to create an initial entry point into the targeted organization's internal network and compromise the system from the inside.

At the heart of this threat lies an advanced malware called 'EtherRAT'. Functioning as a Remote Access Trojan (RAT), this software grants attackers full control over the affected device as soon as it is installed. Through EtherRAT, criminals can delete files, download new malware, record keystrokes, and take screenshots. Such malware is typically hidden to avoid detection by antivirus programs and runs silently in the background. The device turning into a hub for attackers without the victim's knowledge seriously compromises the security of corporate data.

The primary reason scammers succeed with this tactic is the sense of crisis and urgency they create. During the call, victims are often told that there is a critical vulnerability in the system, their accounts have been suspended, or an urgent software update is required. By making the employee follow instructions in a state of panic, they are asked to download a program that provides remote access to their computer or a malicious file. Fake IT (Information Technology) support personnel can easily convince victims because they are highly familiar with internal corporate hierarchy and company jargon. This situation highlights not only the inadequacy of technological security measures but also the critical vulnerability of the human factor in cybersecurity.

It is crucial for organizations to adopt a multi-layered security strategy to protect against such advanced social engineering attacks. It is essential for companies to provide regular, practical training to their employees regarding phishing and fake support calls. It must be emphasized that individuals requesting passwords, codes, or system access during unexpected calls should never be trusted. Additionally, isolating and authorizing corporate communication tools like Microsoft Teams against external threats will enhance security. Technology departments providing clear protocols on how employees should verify information when faced with a genuine issue is also a vital step.

It should not be forgotten that such cyberattacks can have devastating consequences on a corporate scale. Following initial access, attackers typically move laterally within the network to target more privileged accounts. This process paves the way for major crises such as corporate data being encrypted for ransom (ransomware), the theft of intellectual property, or the leakage of customer data. The use of tools like EtherRAT demonstrates that cybercrime networks are becoming increasingly professional and aim to systematically dismantle corporate infrastructures. Therefore, cybersecurity must be treated not merely as an IT issue, but as a matter of strategic threat management that concerns the entire company.