Attackers posing as IT support on Teams abused AD CS to obtain privileged certificates
BREACHMicrosoft Teamsredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Criminals pretended to be IT support on Microsoft Teams and convinced employees to let them take remote control of their computers. They then used weak settings in a Windows certificate system to get login certificates for powerful accounts, including one for a domain controller. Microsoft investigated two such break-ins, one of which led to company data being stolen.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Read the full Microsoft report for detailed mitigation and indicators, as the excerpt is truncated.
- Review AD CS certificate templates and enrolment permissions for insecure settings.
- Audit certificates issued to privileged and domain controller accounts for anything unexpected.
- Brief staff not to grant remote control to anyone claiming to be IT support over Teams.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
The Hacker News
Who and what is in it
Companies