Attackers posing as IT support on Microsoft Teams talked employees into handing over remote control of their computers, then abused weak certificate settings to impersonate privileged accounts and, in one case, a domain controller. Microsoft Threat Intelligence researchers Sagar Patil, Jesse Birch and Tal Tzhori describe two such intrusions, one of which ended in data theft.
The danger is durability. A certificate for a privileged account works independently of that account's password, so resetting the password or reimaging the first workstation does not revoke it. Microsoft stresses that no Teams vulnerability was involved; the attacks relied on social engineering and on insecure or overly permissive Active Directory Certificate Services (AD CS) configurations. The activity is not attributed to a specific threat actor.
A Quick Assist code was the turning point
Both intrusions began with Teams messages and calls from organization-themed onmicrosoft.com tenants with support-style display names. The caller persuaded a user to open Quick Assist and share the connection code, giving the attacker hands-on-keyboard access. During the session the attacker dropped an archive into the Downloads folder, extracted it into a new KB-prefixed folder in the user profile, and launched the payload with a portable Python, Bun or Java runtime, sometimes renamed but still carrying legitimate version metadata. The code then ran host and network discovery and began assessing AD CS.
Case 1: a template that issued admin certificates on request
In the first intrusion the attacker found a certificate template vulnerable to ESC1, a misconfiguration that lets a low-privileged requester obtain an authentication certificate in someone else's name. A first phishing wave aimed at three users yielded certificates for three highly privileged accounts. About 90 minutes after Microsoft Defender's automated attack disruption cut off that session, a larger wave targeting 16 users compromised a second workstation and produced certificates for eight more privileged accounts. Within seconds of obtaining one, the attacker performed DCSync, replicating credential data from a domain controller, while containment was still taking effect.
Disruption blocked more than 1,000 follow-on SMB file-access attempts. But one privileged account had been excluded from automated response, and it stayed usable. The attacker used it to reach a file server and run a renamed copy of Rclone, called SearchApp.exe, copying files up to three years old to an external SFTP server over 20 concurrent transfers.
Case 2: relaying a domain controller's own login
Where ESC1 was not available, the attacker used PetitPotam to make a domain controller authenticate to an attacker-controlled system, then relayed that NTLM authentication to AD CS Web Enrollment, a technique known as ESC8. That produced a certificate for the domain controller's machine account, which the attacker used to obtain a Kerberos ticket as the domain controller. Defender raised ESC8-related alerts, the customer isolated the workstation, and no further progression was observed.
Enforce EPA on Web Enrollment and audit every exclusion
Microsoft's recommendations include:
- Verify unsolicited support requests through a known internal channel before joining a call or starting a remote session, and review Teams external-access and federation policies.
- Restrict remote-support tools to approved products and workflows, and use application control to block unapproved portable runtimes running from user-writable folders.
- Review authentication-capable templates for requester-supplied subject names and broad enrollment rights, and remove Web Enrollment endpoints that are not needed.
- Require HTTPS and Extended Protection for Authentication on enrollment endpoints, and disable NTLM there where feasible, following Microsoft's guidance on mitigating NTLM relay against AD CS.
- Enable Certification Services auditing, and after an incident revoke unauthorized certificates and review active Kerberos tickets separately.
IntelFusions has tracked Teams help desk callers going after domain controllers before. The lesson Microsoft draws from these two cases is narrower and sharper: automated containment protects only the identities it is allowed to touch, and one exclusion was enough to let the data walk out.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.