Category hub: Social engineering and human risk

In one sentence: Quick Assist abuse is when a criminal posing as IT support talks you into opening Windows’ built-in remote help tool, which then gives them full control of your computer.

What it is

Quick Assist is a genuine Windows tool. Microsoft describes it as an application that lets you share your Windows or macOS device with another person over a remote connection, so they can view your screen, annotate it or take full control, usually for troubleshooting.

That makes it useful to a criminal. The tool is trusted and already installed on many PCs. Microsoft’s report on the group it tracks as Storm-1811 shows how it was misused. It was a social engineering problem, not a flaw in Quick Assist.

How it works

1. Email flood. The attacker signs the victim’s address up to many subscription services so the inbox fills with spam. Red Canary and Microsoft both describe this.
2. The call. Posing as IT support or Microsoft, the attacker phones, or contacts the victim on Teams, offering to fix the spam.
3. The code. The victim is asked to start Quick Assist (CTRL + Windows + Q) and type in a security code the attacker supplies, then approve screen sharing. The attacker can then request control.
4. The tools. Microsoft reports a scripted download of further files, then remote management tools such as ScreenConnect and NetSupport Manager, and malware such as Qakbot and Cobalt Strike.
5. The spread. The attacker maps the network and moves around. In several cases Microsoft says they used PsExec to deploy Black Basta ransomware.

Who it affects and how badly

• Sole trader to 10 staff. One approved session gives access to everything on the PC. Worst case: stolen logins and locked files.
• 10 to 250 staff. The Hacker News, citing Rapid7, reported the campaign hit manufacturing, construction, food and beverage and transportation. Offices without a round-the-clock help desk are easy to impersonate.
• 250 plus and regulated firms. Once a foothold exists the group moves across the network. A ransomware incident can mean regulator reports, downtime and lost clients.

Real examples

• Storm-1811. Microsoft Threat Intelligence reported that from mid-April 2024 this financially motivated group impersonated support through voice phishing, delivered remote tools and malware, and ended with Black Basta ransomware. MITRE ATT&CK records the group as G1046 and notes its use of inbox overload to prompt a fake help desk interaction. Microsoft said it was working on warning messages in Quick Assist.
• Microsoft’s report does not name any victim organisation.

How to detect it

• A flood of subscription and newsletter emails to one user, followed by an offer of help.
• Quick Assist, AnyDesk, TeamViewer or ScreenConnect launching on a PC without a ticket.
• New remote management software on a user’s device.
• Teams messages or calls from external accounts named “Help Desk” or “IT Support”.
• New admin accounts or unusual PsExec use after a support call.

How to fix or prevent it

1. Remove or block Quick Assist on managed devices where you do not use it. Microsoft recommends blocking or uninstalling remote tools not in use.
2. Tell staff: only let a helper connect if you started the contact with Microsoft Support or your own IT team.
3. Tell staff to disconnect at once if something seems wrong, and report it.
4. Restrict Teams external access and watch for impersonating tenants.
5. Allow only approved remote support tools, using application control.
6. Use phishing-resistant MFA and limit admin rights on user PCs.
7. Keep tested offline backups.
8. Include fake IT calls in awareness training.

Related terms

• Impersonation of IT support
• Vishing
• Callback phishing
• Ransomware
• Tech support scams
• Pretexting

FAQ

Is Quick Assist itself insecure?
Microsoft describes the attacks as social engineering and misuse of a genuine tool, not a flaw in the tool.

When is it safe to use Quick Assist?
Microsoft advises allowing a helper only if you started contact with Microsoft Support or your own IT support.

Which ransomware has been linked to this tactic?
Microsoft linked Storm-1811’s activity to Black Basta ransomware.

Sources

• https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/
• https://attack.mitre.org/groups/G1046/
• https://www.bleepingcomputer.com/news/security/windows-quick-assist-abused-in-black-basta-ransomware-attacks/
• https://redcanary.com/blog/threat-intelligence/storm-1811-black-basta/
• https://thehackernews.com/2024/05/cybercriminals-exploiting-microsofts.html

How Wolfcore helps

Phishy runs realistic phishing simulations against your own staff and shows you who clicked, so you can train the people attackers target. See Phishy phishing simulation.