Attackers Pose as Help Desk on Teams, Abuse AD CS in Two Intrusions

En bref

• Attackers posed as IT support in Microsoft Teams chats.
• They persuaded users to grant remote control of PCs.
• AD CS was then used to obtain certificates, including for a domain controller.
• The chain enabled elevated account access and data theft.
• No CVE was involved; defenses must focus on identity and certificate controls.

Two separate intrusions followed a similar pattern: someone claiming to be from IT support contacted employees through Microsoft Teams, built enough trust to persuade them to allow remote access, and then moved into certificate infrastructure. The approach relied on familiarity with internal support workflows rather than a software flaw.

Once on the endpoint, the intruders turned to Microsoft's AD CS role. By requesting and obtaining certificates, they could authenticate as higher-privileged identities; the certificates included one tied to a domain controller. That path can turn a single help-desk conversation into control over servers and sensitive information.

The outcome was more than a nuisance. The attackers could operate machines remotely, steal certificates, compromise accounts with elevated rights, and take company data. Because no CVE is involved, patching alone would not have stopped this chain; the weak points were human verification and certificate governance.

For school districts, the lesson is direct. K-12 help desks support staff and students across many devices, and Teams is a familiar channel. An attacker who looks like a colleague or technician can exploit that comfort. Certificate services are especially sensitive because a trusted certificate can outlast password resets and bypass some controls.

What to watch: unexpected Teams messages from purported support staff, remote-session requests, new certificate requests, and authentication from unusual endpoints. Review AD CS templates and issuance rights, and verify help-desk identity through a separate channel.

À faire maintenant

1. Require out-of-band verification for any remote-support request: call the user back on a known number or use a separate approved channel before granting access.
2. Restrict who can request and approve certificates in AD CS; review templates, enrollment permissions, and auto-enrollment for privileged accounts.
3. Monitor Teams for external or impersonating accounts, and block unsolicited remote-control invitations from unverified sources.
4. Enable strong phishing-resistant MFA for help-desk and privileged accounts; separate administrative roles from daily-use accounts.
5. Audit certificate issuance logs for domain controllers and other high-value systems; alert on new certificates and unusual enrollment.
6. Train staff to challenge unexpected IT support messages and to report them through a known reporting path.
7. Review remote monitoring and management tool permissions and require approval for sessions that can control endpoints.

Source originale

The Hacker News