Cybersecurity teams at Rapid7 and Microsoft have identified an ongoing social engineering campaign that leverages Microsoft’s built-in Quick Assist program to gain remote access to victims’ desktops. The only piece of information the threat actors need to kick off the attack is the email address of one or more employees of the target organization. The attackers sign the email address up for many email lists, bombarding the end user with spam emails. The attackers will then call the victim, pretending to be part of the organizations’ IT team, and will offer to install an update to purportedly fix the email issue. The attacker instructs the victim to launch Windows’ Quick Assist tool to grant them access to the machine. Once the threat actor has access, they run a scripted command to download batch and zip files that deliver malicious payloads. One of the batch scripts is used to harvest the victim’s credentials which the victim is prompted to enter as requirement to complete the fake update. Microsoft reports that once the attackers have access to the victim’s machine, multiple tools are downloaded including Qakbot, ScreenConnect, and Cobalt Strike. Once the initial tooling is installed, attackers perform domain enumeration and lateral movement before finally using PsExec to deploy Black Basta ransomware. Black Basta is a Ransomware-as-a-Service operation that is believed to be an off-shoot of the Conti cybercrime group. CTIX analysts recommend that organizations consider blocking remote access tools that are not required by policy, and to educate employees on how to detect tech support scams. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.