Trust Me, I’m IT: Threat Actors Deliver Deno-Based Backdoor “DenoGate” via Microsoft Teams

MITRE Techniques

• [T1566.002 ] Phishing: Spearphishing Link – Attackers delivered malicious instructions and links through Microsoft Teams to entice victims to download and run the fake patch (‘they sent malicious links containing step-by-step instructions guiding victims to download, unpack, and execute…’; ‘Victims were sent a link via Microsoft Teams’).
• [T1114.001 ] Email Collection – Email bombing was used to flood victims’ inboxes as part of the initial social engineering chain (‘subscribed victims’ email addresses to numerous services, flooding their inboxes with spam’).
• [T1219 ] Remote Access Software – The attackers used Microsoft Teams as a legitimate-looking remote communication channel to impersonate IT helpdesk personnel (‘posing as IT helpdesk via Microsoft Teams’).
• [T1059.003 ] Command and Scripting Interpreter: Windows Command Shell – The malware executed commands through cmd.exe to gather data, install persistence, and run arbitrary commands (‘cmd.exe /c “set && ipconfig /all && route print && tasklist”‘, ‘cmd.exe /c “reg add…”‘).
• [T1547.001 ] Registry Run Keys / Startup Folder – DenoGate established persistence by creating a Run key entry under HKCUSoftwareMicrosoftWindowsCurrentVersionRun (‘Persistence via HKCU Run key’).
• [T1105 ] Ingress Tool Transfer – The payload was downloaded from an Amazon S3-hosted page and unpacked on the victim machine (‘sent victims Amazon S3 links to pages containing instructions to download, unpack, and execute the “patch”‘).
• [T1071.001 ] Application Layer Protocol: Web Protocols – DenoGate communicated with C2 over WebSockets and used local HTTP endpoints to relay traffic (‘maintains connection with a CloudFront-based C2 server via WebSocket’).
• [T1090.001 ] Proxy: Internal Proxy – The backdoor could open TCP connections and use the compromised device as a proxy (‘allows threat actors to use the victim’s device as a proxy’).
• [T1046 ] Network Service Discovery – The malware enumerated network configuration and running processes to fingerprint the host (‘set && ipconfig /all && route print && tasklist’).