Windows Quick Assist Exploited in Ransomware Attacks

Security researchers have detected Storm-1811, a financially motivated cybercriminal group, exploiting Quick Assist, a client management tool, in social engineering attacks. 

According to a technical blog post published by Microsoft on Wednesday, Storm-1811, notorious for deploying Black Basta ransomware, has been observed initiating these attacks through voice phishing (vishing) since mid-April 2024, employing tactics like impersonation to gain access to target devices. 

The misuse of Quick Assist, designed for remote troubleshooting, enabled threat actors to establish connections with unsuspecting users, ultimately leading to the deployment of malicious tools and ransomware.

In particular, threat actors have been observed abusing this functionality by impersonating trusted entities like Microsoft support or IT professionals, deceiving users into granting access to their devices.

According to the tech giant, this manipulation is part of a broader trend of tech support scams prevalent in the cybersecurity landscape, where scammers exploit users’ trust for illicit gains.

Read more on similar threats: Scams Now Make Up 75% of Cyber-Threats

In response to these threats, Microsoft is actively investigating the misuse of Quick Assist and implementing measures to enhance transparency and trust within the application. 

Recommendations include educating users on recognizing and reporting tech support scams, as well as blocking or uninstalling remote management tools like Quick Assist when not in use. However, Quick Assist’s default installation on Windows 11 devices presents an inherent risk, necessitating heightened awareness and vigilance among users and organizations.

Social engineering techniques, such as vishing attacks, play a pivotal role in these exploits, with threat actors employing various tactics to deceive users and gain access to their devices. 

Once access is granted, malicious payloads, including Qakbot, Cobalt Strike and remote monitoring and management (RMM) tools like ScreenConnect and NetSupport Manager, are deployed, culminating in the deployment of Black Basta ransomware.

By raising awareness and implementing recommended mitigations, organizations can bolster their defenses and mitigate the risk posed by threat actors exploiting tools like Quick Assist.