{
  "name": "New A0Backdoor Linked to Teams Impersonation and Quick Assist Social Engineering",
  "slug": "new-a0backdoor-linked-to-teams-impersonation-and-quick-assist-social-engineering",
  "description": "A new backdoor, dubbed A0Backdoor, has been discovered in connection with a campaign using email bombing and IT-support impersonation over Microsoft Teams to gain Quick Assist access. The malware's loader exhibits anti-sandbox evasion techniques, and the campaign's command-and-control has shifted to a covert DNS mail exchange-based channel. This activity is attributed to the threat group Blitz Brigantine, also known as Storm-1811 or STAC5777, and shows similarities to Black Basta-linked social-engineering tactics. The attackers use digitally signed MSI packages, often hosted on Microsoft cloud storage, to deliver their proprietary tooling. The A0Backdoor employs sophisticated techniques such as time-based execution windows, runtime decryption, and DNS tunneling for covert communication. The campaign has been active since August 2025, targeting primarily the finance and health sectors.",
  "published": "2026-03-07T08:44:29+00:00",
  "created_at": "2026-03-07T08:44:29+00:00",
  "modified_at": "2026-03-09T10:00:16+00:00",
  "created_at_opencti": "2026-03-07T08:44:29+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-03-07",
    "a0backdoor",
    "dns tunneling",
    "email bombing",
    "sideloading",
    "social engineering",
    "teams impersonation"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "26db06a2319c09918225e59c404448d92fe31262834d70090e941093e6bb650a"
      },
      {
        "id": "",
        "name": "0c99481dcacda99014e1eeef2e12de3db44b5db9879ce33204d3c65469e969ff"
      }
    ],
    "malware": [
      {
        "id": "9dd250d2-d56f-4e1f-84b4-b63a511c7013",
        "name": "A0Backdoor",
        "slug": "a0backdoor"
      }
    ],
    "intrusion_sets": [
      {
        "id": "b4d37cfd-f2c1-4a32-84d9-9674013ee108",
        "name": "Blitz Brigantine",
        "slug": "blitz-brigantine"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Canada"
      },
      {
        "id": "",
        "name": "Finance"
      },
      {
        "id": "",
        "name": "Healthcare"
      },
      {
        "id": "",
        "name": "fsdgh.com"
      }
    ]
  },
  "external_refs": [
    "https://www.bluevoyant.com/blog/new-a0backdoor-linked-to-teams-impersonation-and-quick-assist-social-engineering",
    "https://otx.alienvault.com/pulse/69abf37e75ba997149f9e95c"
  ]
}