Cybercriminals recently infiltrated corporate networks by impersonating IT support staff on Microsoft Teams. They duped employees into granting remote access to their computers, leveraging insecure Active Directory Certificate Services (AD CS) settings to acquire privileged account certificates. Microsoft has reported two such intrusions, with one involving the unauthorized transfer of company data to an external server. The attackers did not exploit any flaws in Microsoft Teams itself but instead capitalized on social engineering tactics and improperly configured AD CS setups.
Initially, attackers posed as help desk personnel on Teams, using familiar support-themed names to deceive employees. They persuaded users to open Quick Assist, a Windows remote-help tool, allowing the attackers direct access to the users' workstations. Once inside, they deployed malicious archives disguised as Windows updates, running them with various runtime environments.
AD CS, responsible for issuing login certificates, was exploited when attackers found a template vulnerability known as ESC1. This flaw allowed them to request certificates impersonating privileged accounts, maintaining access even after passwords were changed or devices wiped. The first wave of attacks targeted a limited number of users, and though Microsoft Defender disrupted most of the attack, one privileged account remained vulnerable. A subsequent attack wave targeted more users, resulting in additional compromised accounts.
In the second intrusion, the attackers used a technique called PetitPotam to induce a domain controller to authenticate to their controlled machine. This method, known as ESC8, allowed them to request a certificate for the domain controller without needing a password. However, Microsoft was able to contain this attack by issuing ESC8 alerts and isolating the affected workstation.
The incidents underscore the importance of properly configured systems and robust response strategies. Microsoft advises focusing on configuration and response measures, as no software flaws were involved. The report highlights how these attacks combined known techniques and illustrates the critical need for comprehensive identity containment strategies.
