#ParsedReport #CompletenessMedium
02-09-2026

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/

Report completeness: Medium

Threats:
Winrm_tool
Msi_loader
Microsoft_quick_assist_tool
Spear-phishing_technique
Powexec
Trojan:win32/fakeall!mtb
Synkloader

Victims:
Enterprise environments, Domain controllers, Certificate authorities, File servers, Database servers, Application servers

TTPs:
Tactics: 7
Technics: 16

IOCs:
File: 18
Hash: 6
Domain: 8

Soft:
Microsoft Defender, Microsoft Teams, Node.js, Active Directory, Windows Installer, Office 365, Microsoft Defender for Endpoint, Azure Blob

Crypto:
ethereum

Algorithms:
base64

Languages:
javascript, powershell, jscript