Attackers impersonate IT help desks on Microsoft Teams to gain remote access and abuse certificate services
- Severity
- High
- Sources
- 1
What happened
No Teams vulnerability was exploited; the chain combined social engineering, Quick Assist sessions and AD CS misconfigurations. Incident one abused an ESC1-vulnerable certificate template to get authentication certificates for three privileged accounts, followed by DCSync activity, and a renamed Rclone copy over SFTP using 20 concurrent transfers. Incident two used ESC8 relay to AD CS Web Enrollment to obtain a domain controller certificate and a TGT. Defenders should restrict external Teams access and unapproved remote tools, review certificate template permissions, enforce HTTPS and EPA on enrollment endpoints, revoke unauthorised certificates and review Kerberos tickets.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Verify unexpected IT support requests through a known internal channel before approving any remote access.
- Restrict external Teams access and unapproved remote-support tools.
- Review certificate template permissions and follow Microsoft's AD CS relay guidance, requiring HTTPS and Extended Protection for Authentication on enrollment endpoints.
- Revoke unauthorised certificates, review Kerberos tickets, and review containment exclusions for privileged accounts.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Malware
Companies