Former Black Basta affiliates chain e-mail bombing with Teams chats to deliver malware

HackerFeeds reported on Oct. 27, 2026 that a current campaign combines email bombing with external Microsoft Teams chats, delivering malware in roughly 15 minutes, activity that may tie to the Black Basta ransomware cartel and is described as wide-scale and ongoing.

ReliaQuest assesses with high confidence that former Black Basta affiliates are running a unified campaign rather than acting as independent copycats, the firm said in an April 14, 2026 report. Black Basta was a Russia-linked ransomware cartel active from early 2022 until its internal chat logs leaked in February 2025. In October 2024, ReliaQuest researchers reported that the cartel had already shifted to Microsoft Teams to pose as IT support.

The intrusion chain begins with mass e-mail bombing: attackers send hundreds of messages in minutes to swamp a target’s inbox. Within minutes, attackers who claim to be IT support reach targets through direct Microsoft Teams messages or telephone calls. They start chats with several users within minutes of one another, including one instance in which chats began just 29 seconds apart.

In some incidents, malicious scripts ran within 12 minutes of the first Teams chat. “In some cases, attackers moved from initial chat engagement to executing malicious scripts in as little as 12 minutes,” ReliaQuest report authors John Dilgen & Alexa Feminella wrote. ReliaQuest says the campaign aims to open a remote shell from the inbox within 10 minutes.

Attackers use Windows Quick Assist, the preinstalled remote assistance tool on Windows 11, and tell targets to press Windows Key + Control + Q and enter a code. Black Basta used Quick Assist extensively from 2024 to 2025. Supremo Remote Desktop serves as a primary remote monitoring and management tool in the campaign, and Black Basta affiliates have used it before. Scripts run after attackers gain remote access and carry names that resemble e-mail tools, including MailAccountWizard.jar.

Researchers saw no ransomware deployment in the incidents, but ReliaQuest assesses the activity as consistent with staging before ransomware.

The attackers rely on disposable onmicrosoft.com tenant accounts and source IP addresses based in Russia. Chat titles and assumed identities draw on internal IT or help desk figures to build user trust. From March 1 to April 1, 2026, 77% of observed incidents targeted senior-level employees, up from 59% in January and February 2026.

In March 2026 alone, nearly one-third of observed Teams phishing activity took place. ReliaQuest says 32% of Teams phishing activity tracked since May 2025 occurred in March 2026; 56% of Teams phishing activity after Black Basta’s decline fell within the first four months of 2026, and 56% of all Teams-based phishing activity since the cartel’s decline occurred in 2026 alone. SC Media reported ReliaQuest’s finding that 56% of Teams phishing in the past year fell within the most recent quarter.

In 2026, manufacturing and professional, scientific, and technical services each accounted for 26% of Black Basta-style incidents. When the cartel was active, its leak site named more manufacturing firms than any other industry. The cartel’s operations also focus heavily on finance and insurance, construction, and technology.

BlueVoyant links the activity to Blitz Brigantine, which researchers also track as Storm-1811, and places it inside the Black Basta ransomware cartel ecosystem. Installers that pose as legitimate Microsoft components place files in CrossDeviceService and Teams folders and sideload a malicious DLL (dynamic-link library). A0Backdoor, a malware payload, maintains persistence, gathers host information through standard Windows APIs, and relies on DNS tunneling — encoding data in DNS queries to communicate with attacker-controlled servers — for command and control. Those queries go to public resolvers such as 1.1.1.1 and 8.8.8.8.

The attackers insert commands into DNS mail exchange records and hide data inside domain responses. A loader hides its core functions with runtime decryption routines until the malware runs. “These installers place files in directories associated with CrossDeviceService and Teams, allowing the attackers to sideload a malicious dynamic-link library (DLL),” BlueVoyant said. BlueVoyant sees the campaign as an evolution of the Blitz Brigantine playbook, combining familiar social engineering with new malware.

According to BlueVoyant, the Teams and Quick Assist campaign dates back to at least Aug. 2025. Targets have included organizations in finance and a global health-aligned organization.

Technijian places Black Basta’s activity in April 2022 and describes the group as infamous. “Black Basta is an infamous ransomware group, active since April 2022,” Technijian said. The cartel grew out of factions created by former Conti members after the syndicate dissolved. Technijian says the cartel depends on social engineering, malware botnets, and system vulnerabilities to breach networks and demand ransoms.

Technijian says the cartel began by flooding employee inboxes with large amounts of e-mail and posing as IT support to address a fabricated spam problem. According to Technijian, an October 2024 ReliaQuest report says the cartel turned to Microsoft Teams because the platform is widely trusted in the workplace. Attackers built fake IT support accounts on Entra ID tenants using names like authentic help desk services, including securityadminhelper.onmicrosoft.com and supportserviceadmin.onmicrosoft.com. The attackers use realistic names such as Help Desk in one-on-one Teams chats that impersonate IT support.

Technijian notes that QR codes sometimes appear in chats and may point to malicious websites or phishing pages. Technijian says the cartel has guided victims to install AnyDesk or Windows Quick Assist for remote access, and has installed payloads such as AntispamAccount.exe and AntispamUpdate.exe. Technijian says SystemBC is among the payloads, working as proxy malware that lets attackers move deeper into the network.

Defenders should limit external user access in Microsoft Teams or restrict it to trusted domains only. Organizations should restrict or allow-list remote monitoring and management tools such as Quick Assist to authorized IT staff only. Defenders should use out-of-band verification, such as a callback to a registered phone number, for help desk requests that involve remote access.

ReliaQuest recommends targeted simulation training for senior personnel that imitates e-mail bombing and urgent Teams messages from fake IT support. The firm says an e-mail bomb should trigger immediate user notification and closer review of any IT support outreach that follows. Technijian recommends enabling logging for Teams events such as ChatCreated, so defenders can track suspicious activity in real time.

ReliaQuest says earlier non-senior targets often held titles such as project manager, roles that look like management but carry fewer privileges. It attributes part of the increase in executive targeting to the removal of those roles from automated targeting scripts. ReliaQuest tracked high-level access from day one in 47% of all attacks during 2025, a trend the firm uses to explain why attackers focus on senior leaders who already hold privileged access.

ReliaQuest expects the next likely remote monitoring and management tool rotation to favor tools already installed in enterprises, such as Remote Desktop, or cloud-native options. It expects targeting to grow more selective, concentrating on CFOs, finance leaders, research and development leadership, and plant or operations management. ReliaQuest says pretexts will likely shift and tooling will rotate as detections improve for IT impersonation, repeated Teams outreach, or known remote monitoring and management tools. ReliaQuest says that within 12 months, most social engineering-led initial access campaigns against enterprises will probably rely on help desk impersonation.

At times, some extortion activity lines up with Chaos ransomware, and certain tooling and naming conventions match FIN7. ReliaQuest researchers say former Black Basta affiliates may be regrouping under a new name. ReliaQuest also considers collaboration with a separate ransomware cartel or extortion group, or a different actor using methods like Black Basta’s.