CMMC guide
Attackers are posing as IT in Microsoft Teams chats. What should a defense supplier change this week?
Arctic Wolf Labs published research on October 26, 2026 covering more than 400 incidents in which attackers used Microsoft Teams external chat to reach employees, pose as IT support and get a remote session on their computers. No Teams vulnerability was involved. The attackers used external access, the federation feature that lets accounts in other Microsoft 365 tenants chat with your users, and it is on by default. For a company that handles Controlled Unclassified Information, this is a question about external connections and social engineering. Most of the answer is a setting, a rule and a record.
What did Arctic Wolf report?
In its Beyond the Inbox research, Arctic Wolf Labs says it analyzed more than 400 incidents of Teams external chat abuse used for social engineering and initial access. In 30 to 40 percent of those cases the attacker's account sat on a default onmicrosoft.com tenant domain, the kind that needs no verification and takes minutes to create. Among paid domains seen in recent months, about half were .top and about 40 percent were .com.
Display names are built to pass as internal: "IT Support (Internal)", friendly first names, emoji, and more recently the target company's own name or domain. Microsoft first documented the technique in the Black Basta (Storm-1811) campaign in mid 2024. The figures here are Arctic Wolf's reported findings from the incidents it analyzed.
How does one of these attacks run?
- The inbox flood. The target receives hundreds of newsletter and subscription confirmations within minutes.
- The chat. An external Teams account named like internal IT offers to fix the flood. Arctic Wolf says a voice call inside Teams is frequent.
- The remote session. The caller asks the user to open a remote tool. Quick Assist is the most common because it is built into Windows, signed by Microsoft and needs no install, and the user only reads back a six digit code. Arctic Wolf also saw AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport and LogMeIn.
- The spread. Several users at one company are often targeted within about five minutes. In chains customers reported to Arctic Wolf, the payload ran in under 15 minutes once a victim engaged.
Why is Teams external access an external connection question?
NIST SP 800-171 Rev 2 requirement 3.1.20, AC.L2-3.1.20 in CMMC, reads: "Verify and control/limit connections to and use of external systems." A Microsoft 365 tenant you do not own is a system you have no authority over. Open federation lets any of those tenants reach your users by chat and voice.
The NIST discussion of that requirement says organizations establish terms and conditions for the use of external systems, and may restrict their own personnel where terms cannot be agreed. Deciding which outside domains your users may chat with, and writing that decision down, fits that description. Leaving federation open to every tenant is also a decision. It is just not a recorded one.
Which other requirements does it touch?
- 3.1.12, Monitor and control remote access sessions. A Quick Assist session started at an outsider's request is remote access to your system. Decide which remote tools are sanctioned and how a session gets approved.
- 3.4.8, application execution policy. The requirement calls for a deny-by-exception or permit-by-exception policy for software. Remote tools you have not sanctioned belong on the wrong side of it.
- 3.2.1, security awareness. Managers, administrators and users have to be made aware of the security risks of their activities and the procedures that apply. Teaching staff to read the External tag and to call IT back on a known number is that kind of procedure.
What should a defense supplier do this week?
- In the Teams admin center, under Users, External access, allow only the specific external domains you work with.
- Block chat with unmanaged Teams accounts unless a documented business need says otherwise.
- Block federation with trial tenants with Set-CsTenantFederationConfiguration -ExternalAccessWithTrialTenants "Blocked".
- Restrict or remove Quick Assist and any remote tool you have not sanctioned.
- Require an out of band callback on a known number before anyone accepts a remote access request.
- Tell staff in writing how your real IT contacts them, and show them the Teams option for reporting a suspicious message.
Does changing these settings make us compliant?
No. A setting is one piece of an implementation, not an assessment result. CMMC Level 2 is judged against all 110 requirements, the System Security Plan that describes how each is met, and the evidence behind them. What these changes give you is something concrete to document: the federation policy, the allowed domain list, the sanctioned remote tool, the callback procedure and the training record. Put each one in the SSP where it belongs, and log any attempted chat you catch as a security event with a date and an owner.
Sources
- Arctic Wolf Labs, Beyond the Inbox, Shubham Dubey, October 26, 2026
- Arctic Wolf, Similar tradecraft across two Teams and Quick Assist intrusions
- TechNadu, Microsoft Teams external chat abused in 400 incidents
- BleepingComputer, Microsoft Teams increasingly abused in helpdesk impersonation attacks
- NIST SP 800-171 Rev 2, Protecting Controlled Unclassified Information
Questions contractors ask
FAQWas Microsoft Teams hacked?
No. Arctic Wolf reports that no Teams vulnerability was exploited. The attackers used external access, a standard feature that is on by default.
Does Teams external access fall under AC.L2-3.1.20?
Requirement 3.1.20 is about verifying and controlling or limiting connections to and use of external systems. Chat and voice federation with tenants you do not control is a connection to external systems, so it is reasonable to address it there and describe the decision in your SSP. How an assessor reads it in your environment is their call.
Will blocking external chat make us CMMC compliant?
No. It is one control decision among many. CMMC Level 2 is assessed against all 110 requirements of NIST SP 800-171 Rev 2 and the evidence behind each one.
What should staff do if IT support messages them on Teams out of nowhere?
Close the chat, do not open any remote tool or read back any code, and call IT on a number they already have.
Already know you want to talk?
BOOK A CALLSkip the form. Pick a time and talk to us directly.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.