Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged accounts, including one for a domain controller.

Microsoft said in a report that it investigated two such intrusions, one of which resulted in company data being copied to an external server.

The attackers exploited no flaw in Teams itself. They relied on social engineering and on AD CS that had been set up insecurely, and Microsoft did not tie the activity to any known group.

Both intrusions started the same way, Microsoft said. The attackers messaged and called employees on Teams while posing as the company's own IT or help desk, working from outside tenants with support-themed names so the contact looked familiar.

They talked each user into opening Quick Assist, a remote-help tool built into Windows, and reading the connection code back to them. That gave the attacker direct, hands-on control of the workstation.

From there, the attacker dropped an archive into the Downloads folder, unpacked it into a new folder named to resemble a Windows update, and ran its contents with a portable Python, Bun, or Java runtime. File names alone were a weak signal, because one copy was renamed while still carrying the real runtime's version details.

AD CS is the Windows role that issues the certificates users and computers present when they log in. A certificate from a poorly configured template lets whoever holds it sign in as the account it names.

Source link