ms teams is now a C2 (command-and-control)

Summary: The video discusses the command and control infrastructure dubbed “Convo C2,” which enables red teamers to execute system commands on compromised hosts via Microsoft Teams. Released in November 2024, this tool cleverly hides data within HTML tags and utilizes Microsoft servers for communication, making detection by security solutions challenging. The presenter aims to demonstrate its setup and functionality in a controlled learning environment, providing insights into the tool’s operation and its implications for cybersecurity.

Keypoints:

Convo C2 allows execution of system commands on compromised hosts through Microsoft Teams.

It utilizes hidden span tags in Teams messages for data infiltration and uses URLs to exfiltrate outputs.

There is no direct communication between attacker and victim, which complicates detection by antivirus and security solutions.

The tool was created by Centurion CX and is designed for educational purposes.

The video showcases setup procedures for demonstrating the functionality of Convo C2 in a safe environment.

Victims need to accept a chat from the attacker, but this can be bypassed in real scenarios.

A dedicated server (Linux) is required to host the command and control function.

Various software tools and protocols (like Burp Suite) are used to facilitate the setup and communication between the attacker and victim.

While the demonstration uses accounts within the same organization, the tool is effective for external attacks as well.

The presenter emphasizes the educational goal of the video and encourages viewers to explore the tool by providing links to resources.