Hackers recently impersonated IT support staff on Microsoft Teams to gain unauthorized access to company systems, leveraging insecure configurations in Active Directory Certificate Services (AD CS) to steal sensitive data. Microsoft investigated two such incidents, revealing that attackers had no need for vulnerabilities in Teams itself but rather relied on social engineering techniques and improperly set up AD CS.
Initial Approach and Attack Technique
According to Microsoft, the initial phase of these attacks involved the cybercriminals contacting employees via Teams, pretending to be company IT personnel. Using support-themed names, they successfully deceived employees into granting them remote access through Windows’ Quick Assist tool.
Once access was secured, attackers deployed files into the system’s Download folder, disguised as legitimate Windows updates, and executed them using portable runtimes. This tactic allowed them to bypass initial security layers and establish a foothold within the targeted networks.
Exploiting AD CS Vulnerabilities
In the first recorded incident, attackers identified a vulnerability in AD CS known as ESC1, allowing them to request certificates for privileged accounts. Despite Microsoft’s automated defenses blocking most of these efforts, one account remained vulnerable, enabling further exploitation.
The second attack exploited a different method, known as ESC8, where attackers used the PetitPotam technique to coerce domain controllers into granting unauthorized certificate requests. This method did not require password access, thus escalating the attack’s severity.
Defensive Measures and Future Outlook
Microsoft advises reinforcing security measures by limiting which external Teams tenants can contact employees and mandating verification of unexpected support requests through established internal channels. Additionally, reviewing and securing certificate templates and enabling Extended Protection for Authentication (EPA) are recommended practices.
While Microsoft did not associate these attacks with any specific group or provide exact dates, it is evident that the utilized methods are established vulnerabilities. With newer Windows Server versions offering better default protection, organizations are encouraged to update their systems and audit security configurations regularly.
Microsoft’s report emphasizes the importance of proactive defense strategies and highlights specific indicators of compromise, such as Defender alerts and file hashes related to the initial-access scripts. Organizations must remain vigilant and adapt to evolving cybersecurity threats to safeguard their data effectively.
