Breach · 1 source · latest 13h

Attackers impersonate IT help desks on Microsoft Teams to gain remote access and abuse certificate services

BREACHMicrosoft Teamsredteam/daily · 1 source

Severity: High
Sources: 1

What happened

Microsoft investigated two intrusions in which attackers impersonated help desk staff via Teams chats and calls and got users to approve Quick Assist remote-support sessions. The attackers dropped portable Python, Bun or Java runtimes and staged scripts, then abused weak Active Directory Certificate Services configurations to obtain certificates for privileged accounts. In one case an excluded privileged account was used to exfiltrate files with Rclone to an external SFTP server, and Microsoft Defender blocked over 1,000 subsequent SMB file-access attempts.

For IT people · Written by AI from 1 source · Wrong?

What to do

Verify unexpected IT support requests through a known internal channel before approving any remote access.
Restrict external Teams access and unapproved remote-support tools.
Review certificate template permissions and follow Microsoft's AD CS relay guidance, requiring HTTPS and Extended Protection for Authentication on enrollment endpoints.
Revoke unauthorised certificates, review Kerberos tickets, and review containment exclusions for privileged accounts.

Written by AI from the sources, checked against them

Read the full story at the source