Microsoft warns of Quick Assist abuse

In a recent blog post, Microsoft warns of a new threat in which criminals abuse Quick Assist to install ransomware. The criminal group Storm-1811 uses social engineering techniques to spread the dreaded Black Basta ransomware via Quick Assist.

How does the attack work? ️‍♂️

Criminals call victims and pretend to be legitimate individuals, a technique known as vishing. Here is a step-by-step overview of their methods:

• Phone contact: The criminals call the victim and pretend to be a trusted source.
• ️ Start Quick Assist: They ask the victim to start Quick Assist, such as by pressing the key combination CTRL + Windows + Q.
• Enter security code: The victim is prompted to enter the security code provided by the attacker.
• Malicious software installation: Scripts are then used to install rogue software, such as the Black Basta ransomware, on the computer.

Microsoft’s Recommendations

Microsoft has some key recommendations to mitigate this threat:

• ❌ Disable Quick Assist: Consider disabling Quick Assist if it is not necessary.
• ️ Use Remote Help: Consider using Remote Help, a paid alternative that limits assistance to devices within your own organization/tenant.
• A wareness and training: Ensure employees are aware of this threat and know how to recognize and report suspicious activity.

Why is Quick Assist so risky? ⚠️

Quick Assist, a tool installed by default on Windows 10 and 11, can be easily launched with the key combination CTRL + Windows + Q. This makes it an attractive target for attackers because:

• ‍ Less suspicion: The tool is already present and known to many users, which creates less distrust.
• Easy access: The combination of standard installation and easy access makes it a convenient tool for malicious people.

How can you protect yourself?

• Be careful of unsolicited calls: Don’t simply trust phone calls or messages asking for access to your computer.
• Verify the source: Always verify the identity of the person offering help, especially if sensitive information is involved.
• Update regularly: Make sure your Windows and all software are up-to-date with the latest security updates.
• ️ Use security software: Install and use reliable antivirus and anti-malware programs.

What to do in case of suspicious activity?

• Report it immediately: Contact your IT department or Microsoft’s official support channels.
• Disconnect your device: If you suspect your system has been compromised, disconnect the Internet connection immediately.
• Run a full scan: Have your security software run a comprehensive scan to detect and remove any threats.

Other Tools and Their Risks ️

Although this article deals specifically with Quick Assist, there are other tools such as AnyDesk and TeamViewer that can be used for similar attacks. The difference, however, is that these tools are not installed by default on Windows devices, so they may be less likely to be trusted by victims.

Conclusion

It is crucial to remain vigilant to this new form of attack and take the necessary steps to protect your organization. By creating awareness and implementing security measures, you can significantly reduce risks.