Attackers posing as IT support on Teams abused AD CS to obtain privileged certificates
- Severity
- High
- Sources
- 1
What happened
Threat actors posed as IT support in Microsoft Teams to obtain remote control of user workstations, then abused insecure AD CS configurations to request authentication certificates for privileged accounts, including a domain controller account. Microsoft investigated two intrusions, one of which led to data theft. No CVE or affected versions are named in the excerpt, which is truncated. Defenders should review AD CS certificate templates and enrolment permissions, audit certificates issued to privileged and machine accounts, and check Teams for external impersonation and unsolicited remote-control requests. The full Microsoft report should be consulted for detailed indicators.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Read the full Microsoft report for detailed mitigation and indicators, as the excerpt is truncated.
- Review AD CS certificate templates and enrolment permissions for insecure settings.
- Audit certificates issued to privileged and domain controller accounts for anything unexpected.
- Brief staff not to grant remote control to anyone claiming to be IT support over Teams.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Companies