How Microsoft Teams Calls Are Being Weaponized to Deploy Matanbuchus Ransomware | Full Guide

In July 2026, cybercriminals began exploiting Microsoft Teams calls to deploy Matanbuchus ransomware through social engineering. Attackers impersonate IT support via Teams, using Quick Assist and PowerShell commands to execute malware. This blog explains how the attack works step-by-step, outlines its impact on businesses, and provides actionable prevention tips like disabling Quick Assist, limiting PowerShell, and training employees to recognize social engineering threats.

Jul 17, 2025 - 11:03

Updated: 15 days ago

102k

How Microsoft Teams Calls Are Being Weaponized to Deploy Matanbuchus Ransomware | Full Guide

Quick answer: Attackers call employees on Microsoft Teams pretending to be IT support, then persuade them to open Quick Assist and run PowerShell commands. Those commands install the Matanbuchus loader, which can bring ransomware or infostealers. Defend by training staff, restricting Quick Assist, monitoring PowerShell and keeping tested backups.

Key takeaways

Attackers pose as IT support on Teams and ask staff to open Quick Assist.
Block external Teams calls from unknown tenants.
IT will not ask you to run PowerShell.

What Are the Attack Flow and Protection Measures?
How the Attack Works: Step-by-Step Breakdown
Why This Attack Matters
How Do You Protect Against It?
Conclusion

A sophisticated cyberattack method now uses Microsoft Teams calls to deliver Matanbuchus ransomware. This attack bypasses traditional email-based defenses and exploits human trust in real-time communication.

A new and sophisticated cyberattack technique has emerged that uses Microsoft Teams calls as a delivery mechanism for the Matanbuchus ransomware loader. Security researchers have confirmed that attackers are impersonating IT support staff via Teams video calls, convincing victims to execute malicious PowerShell commands. This is a significant change in ransomware delivery tactics, because it abuses trusted business collaboration tools.

How Microsoft Teams Calls Are Being Weaponized to Deploy Matanbuchus Ransomware | Full Guide

What Are the Attack Flow and Protection Measures?

Attack Stage	Description	Recommended Defense
Social Engineering Call	Impersonating IT via Microsoft Teams	Employee security training and awareness
Quick Assist Activation	Convincing users to grant remote access	Disable or restrict Microsoft Quick Assist
PowerShell Command Execution	Running commands to install Matanbuchus loader	Monitor PowerShell usage; apply execution policies
Loader Deployment	Deploying Matanbuchus 3.0 to execute ransomware or steal data	Endpoint protection, behavior-based detection tools
Persistence and Impact	Encrypting files, exfiltrating data	Data backups, incident response planning

How the Attack Works: Step-by-Step Breakdown

1. Social Engineering via Teams Calls

Attackers initiate Teams calls posing as IT staff, using urgency and authority to trick employees.

2. Remote Access via Quick Assist

Victims are guided to enable Quick Assist, giving attackers full remote access to their systems.

3. PowerShell Command Execution

Once connected, attackers execute PowerShell scripts to silently deploy malware loaders.

4. Matanbuchus 3.0 Deployment

The loader installs ransomware, remote access tools, or infostealers without triggering traditional antivirus software.

Why This Attack Matters

Bypasses Email Security Filters
Higher Trust Due to Live Calls
Uses Legitimate Windows Tools (Living Off the Land)

How Do You Protect Against It?

Train Employees on social engineering threats specific to video conferencing.
Disable Quick Assist where not needed using Group Policy or endpoint management tools.
Limit PowerShell Usage and monitor unusual command execution.
Implement MFA and strong authentication measures for Microsoft accounts.
Maintain Regular Backups of critical systems and files.

Conclusion

Weaponizing Microsoft Teams calls is a wake-up call for organizations relying on collaborative tools. Security policies must evolve beyond email filters to address live social engineering attacks.

To take this further with guided labs and an instructor, see our learning SOC operations with labs.

Reference

For the authoritative details, see Microsoft Learn.

Frequently Asked Questions

Matanbuchus ransomware is a malware strain designed to encrypt files and sometimes exfiltrate data from infected systems, demanding payment from victims to restore access.

Cybercriminals impersonate IT support via Teams calls, use social engineering to convince employees to grant remote access, and execute malicious scripts like Matanbuchus.

Quick Assist is a Windows tool that allows remote control of a device for troubleshooting, which attackers misuse to deploy malware during social engineering attacks.

Once remote access is gained, attackers run PowerShell commands to download and execute malicious loaders like Matanbuchus 3.0.

It’s the latest version of the Matanbuchus ransomware loader used in July 2025 attacks, designed to silently deliver malware on compromised devices.

Because of its widespread use in business environments and its real-time communication features, which attackers exploit to build trust quickly.

Social engineering refers to manipulating people into revealing confidential information or performing actions that compromise security.

Yes, organizations can configure Teams policies to limit calls from external users or require verification before allowing new contacts.

It combines video call trust, legitimate Windows tools (like Quick Assist), and script-based malware deployment, bypassing traditional email-based phishing filters.

By training employees, disabling unnecessary tools like Quick Assist, limiting PowerShell usage, and monitoring unusual behavior.

No, but the 3.0 version includes updated delivery mechanisms as seen in the 2025 Microsoft Teams weaponization campaign.

These attacks use built-in tools like PowerShell or Quick Assist instead of downloading external malware, making detection harder.

Quick Assist can be disabled through Group Policy Editor or endpoint management systems like Intune.

Ransom demands vary, but they can range from a few thousand to millions of dollars depending on the target organization.

Some security products may detect parts of the attack chain, but living-off-the-land tactics often evade signature-based detection.

Microsoft regularly updates its security features but also emphasizes user awareness and organizational policies to limit these risks.

Matanbuchus primarily targets Windows systems, especially in environments that use Microsoft Teams.

EDR tools can help detect unusual script execution, unauthorized remote access, and other indicators of compromise.

By impersonating known IT support, using official-sounding language, and creating urgency.

Social engineering via video calls has been noted in the past, but its use with ransomware like Matanbuchus 3.0 is a newer development.

Finance, healthcare, education, and tech companies that rely heavily on Microsoft Teams and remote work setups.

Always verify the identity of unknown contacts, avoid granting remote access without double-checking, and report suspicious behavior.

It encrypts files, may steal data, and displays a ransom note demanding payment for decryption.

Yes, depending on its configuration and permissions, it can move laterally to infect other devices.

MFA helps prevent account hijacking but does not directly prevent social engineering via live calls.

It removes one avenue attackers can use to gain remote access without needing to install third-party tools.

Not directly, but attackers can initiate calls under false pretenses, tricking users into granting access.

Teams is used to initiate social engineering, while PowerShell is the tool used to deploy the ransomware payload.

Yes, especially if they use Microsoft Teams without strong security policies or employee training.

Deployment can occur within minutes once remote access is established, making swift detection critical.

You can follow updates from cybersecurity blogs, vendors like Microsoft and SentinelOne, and threat intelligence platforms.

Interested in this course? Get a callback from our experts.

Tags:

OSCP Buffer Overflow Lab Setup for Beginners: A Safe, Current Step-by-Step Guide

What's Your Reaction?

Like 0

Dislike 0

Love 0

Funny 0

Wow 0

Sad 0

Angry 0

Vaishnavi

Vaishnavi is a skilled tech professional at the Ethical Hacking Training Institute in Pune, responsible for managing and optimizing the technical infrastructure that supports advanced cybersecurity education. With deep expertise in network security, backend operations, and system performance, she ensures that practical labs, online modules, and assessments run smoothly and securely. Her behind-the-scenes contributions play a vital role in delivering a seamless and secure learning experience for aspiring ethical hackers.