SynkLoader Mimic as IT Support Personnel Attacking Users Via Microsoft Teams

Severity

Medium

Detail

Threat actors are increasingly abusing trusted enterprise collaboration platforms to bypass traditional email-centric security perimeters. ReliaQuest Threat Research recently identified a campaign deploying SynkLoader, a hash-gated PowerShell loader, using targeted Microsoft Teams impersonation and voice phishing (vishing).

Operating under the guise of internal IT support, attackers deceive end users into executing a malicious MSI installer masquerading as a system repair utility. By hosting payloads on legitimate Azure Blob Storage and executing subsequent operational phases in memory, SynkLoader evades standard edge controls and complicates forensic analysis.

How?

The attack sequence begins when a threat actor contacts an employee through a Microsoft Teams message or a direct phone call (vishing), impersonating an internal IT support technician. The attacker fabricates a technical issue and directs the user to download a supposed fix named PowerShell Cleaner.msi. To bypass basic web content filters and domain reputation checks, the malicious installer is hosted directly on legitimate Azure Blob Storage infrastructure.

Once launched on the victim’s endpoint, the MSI installer initiates the SynkLoader execution chain. Before dropping its next-stage components, SynkLoader inspects the encrypted secondary payload and verifies its cryptographic hash. If the hash does not match expected parameters—such as when running inside an automated sandbox or reverse-engineering environment—the loader silently terminates execution. This environmental check conceals the complete attack sequence from automated threat analysis.

When validation succeeds, SynkLoader decrypts the secondary payload purely in memory, evading traditional disk-based antivirus detection. It then deploys a lightweight Python backdoor that contains minimal static functionality. Instead of embedding its features within the initial payload, the backdoor relies on active command-and-control (C2) servers to dynamically stream operational modules at runtime. If C2 servers are unreachable, the backdoor remains dormant, creating significant inspection gaps for forensic analysts reviewing static files.

Conclusion

SynkLoader illustrates how threat actors combine trusted communication channels, legitimate cloud services, and memory-only execution to bypass perimeter security. Defensive postures must focus on verifying user identity and restricting unapproved software delivery.

Defensive Recommendations & Mitigation Guidance

• Restrict Messaging: Limit tenant-to-tenant external communications in Microsoft Teams to authorized domains only.

• Out-of-Band Verification: Require employees to independently confirm unrequested IT support requests via established internal channels before downloading files.

• Monitor Installer Execution: Configure EDR solutions to alert on MSI installers executing from user-writable directories (e.g., \Downloads\, \Temp\) or cloud storage URLs.

• Script & Process Telemetry: Enable PowerShell Script Block Logging (Event ID 4104) and monitor unauthorized Python executions on standard enterprise endpoints.

• Incident Response: Immediately isolate endpoints executing suspicious MSI files and preserve disk memory/logs for forensic analysis of C2 traffic.

Source

https://cybersecuritynews.com/synkloader-mimic-as-it-support/