Red Teaming: Executing System Commands via Microsoft Teams with convoC2

A revolutionary tool has emerged in the red teaming landscape, introducing an advanced technique to execute system commands on compromised hosts via Microsoft Teams.

This Command and Control (C2) infrastructure, known as convoC2, exploits the popular collaboration platform to facilitate data infiltration and exfiltration, significantly complicating detection efforts for blue teams.

convoC2 embeds commands within concealed tags in Microsoft Teams messages. These commands are executed on the compromised host, with the output ingeniously hidden in the image URLs of Adaptive Cards. This mechanism triggers out-of-band requests to a C2 server, creating a covert communication channel.

What sets this tool apart is its stealth. There is no direct communication between the attacker and the compromised system.

According to security analyst Fabio Cinicolo (cxnturi0n), all HTTP requests from the victim’s machine are routed exclusively to Microsoft servers. Since most antivirus solutions overlook Microsoft Teams log files, this malicious activity can remain undetected, posing a significant challenge for defenders.

Technical Analysis

1. Cross-Platform Compatibility: The tool is effective across multiple environments, functioning seamlessly on both the new Teams version for Windows 11 and the legacy Teams version on Windows 10.
2. External Organization Attacks: The attacker does not need to belong to the same organization as the victim, greatly broadening the scope of potential targets and increasing the tool’s attack surface.
3. Preemptive Command Execution: Commands can be received and executed on the victim’s system even if the chat from the external attacker has not been accepted or viewed. This is made possible by Microsoft Teams’ message caching mechanism, which stores data in log files regardless of user interaction.

The convoC2 infrastructure is composed of two primary components: a server and an agent.

The server, easily deployed on a public-facing host, oversees the Command and Control (C2) operations.

The agent, installed on the victim’s machine, interacts with the Teams log file to execute received commands.

To leverage this tool, red team operators must:

1. Set up a Teams channel with a Workflow Incoming Webhook.
2. Retrieve the necessary IDs and authentication tokens.
3. Confirm that Teams is running on the victim’s host, even in the background.

While convoC2 introduces a significant evolution in red team methodologies, it is critical to stress its use strictly within authorized and ethical hacking scenarios.

The tool’s potential misuse highlights the urgency for robust security measures and proactive monitoring of collaboration platforms like Microsoft Teams.

convoC2 exemplifies the rapidly changing cybersecurity landscape, where even widely trusted platforms can become avenues for sophisticated attacks. As red teams employ such advanced tactics, blue teams must elevate their vigilance, continuously refining their detection and prevention strategies to address these emerging threats.