Known for its origins as a faction of the Conti cybercriminal group, Black Basta has been observed shifting from traditional email and phone-based attacks to leveraging Microsoft Teams, where threat actors pose as IT support to address fabricated spam issues. By creating deceptive accounts with names that mimic help desk services (like securityadminhelper.onmicrosoft[.]com, supportserviceadmin.onmicrosoft[.]com,supportadministrator.onmicrosoft[.]com, cybersecurityadmin.onmicrosoft[.]com), the attackers establish one-on-one chats with employees, aiming to trick them into installing remote access tools like AnyDesk. This access allows the attackers to install further malicious payloads, including “AntispamAccount.exe” and the notorious Cobalt Strike, to facilitate deeper network penetration and eventual ransomware deployment. Further investigations into these attacks by cybersecurity researchers revealed that the malicious actors are likely operating out of Russia, as indicated by time zone data. The use of QR codes in chats adds another layer of complexity, though their specific function remains undetermined. To counteract these threats, CTIX analysts advise organizations to restrict external communications on Microsoft Teams, permitting interactions only from trusted domains. Additionally, enabling logging, especially for chat creation events, can help detect and mitigate suspicious activities.