Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data
AI-summarised brief · reviewed before publication
Microsoft reported two intrusions in which attackers pretended to be IT support on Microsoft Teams and convinced employees to grant control via Windows Quick Assist. After gaining access, the hackers exploited Active Directory Certificate Services (AD CS) templates to issue login certificates for privileged accounts, including a domain controller. One intrusion used an ESC1‑type template that let low‑privilege users request certificates for privileged accounts; another employed the PetitPotam relay technique (ESC8) to obtain a domain‑controller certificate without a password. Automatic disruption by Microsoft Defender halted most sessions, but an excluded privileged account remained active long enough for the attackers to copy data to an SFTP server. No software flaw was involved, and Microsoft did not attribute the attacks to a group.
💡 Why It Matters
- · The abuse shows that insecure AD CS configurations can turn routine support calls into a pathway for stealing privileged credentials and exfiltrating data.
