Attackers posing as IT support on Teams abused AD CS to obtain privileged certificates
BREACHMicrosoft Teamsredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Attackers impersonated IT support over Microsoft Teams to persuade employees to grant remote control of their PCs. They then exploited insecure Active Directory Certificate Services (AD CS) configurations to obtain login certificates for privileged accounts, including a domain controller. Microsoft reported investigating two such intrusions, one of which resulted in company data being stolen; the excerpt is truncated.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Read the full Microsoft report for detailed mitigation and indicators, as the excerpt is truncated.
- Review AD CS certificate templates and enrolment permissions for insecure settings.
- Audit certificates issued to privileged and domain controller accounts for anything unexpected.
- Brief staff not to grant remote control to anyone claiming to be IT support over Teams.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
The Hacker News
Who and what is in it
Companies