Fake Teams IT help desk sessions abused AD CS for domain access
Original title: Hackers Impersonate IT Help Desk on Microsoft Teams to Gain Domain Admin Access via AD CS Attacks
Two Microsoft-disclosed intrusions used Quick Assist plus ESC1 or ESC8, then DCSync and Rclone in one case.
Microsoft disclosed two customer intrusions on October 30, 2026. Operators messaged and called employees on Teams as IT support, persuaded them to start Quick Assist, then abused misconfigured Active Directory Certificate Services. The first case used an ESC1 template to obtain privileged certificates, ran DCSync, and copied files with renamed Rclone. The second used PetitPotam and NTLM relay against ESC8 Web Enrollment to obtain a domain-controller certificate. Microsoft has not named an actor, and the activity did not exploit a Teams flaw.
Unconfirmed: Microsoft has not attributed the activity to a named threat actor.
- The first wave hit three users and obtained certificates for three privileged accounts.
- A later wave targeted 16 users and secured certificates for eight more privileged accounts.
- Defender blocked more than 1,000 SMB attempts, but DCSync still ran during containment.
- One excluded account copied files to external SFTP using Rclone renamed SearchApp.exe.
- Password resets do not revoke certificates, and revocation does not kill existing tickets.
Impact: Privileged certificates, DCSync, and copied files
| Product | Affected |
|---|---|
| Microsoft Active Directory Certificate Services | — |
- 1.Restrict external Teams access and verify unsolicited support requests before using Quick Assist.
- 2.Require HTTPS and Extended Protection for Authentication on enrollment and disable NTLM where feasible.
- 3.Revoke unauthorized certificates and investigate Kerberos tickets separately from password resets.
- ATT&CK
- T1649 Steal or Forge Authentication CertificatesT1003.006 OS Credential Dumping: DCSyncT1187 Forced AuthenticationT1048 Exfiltration Over Alternative Protocol
- Vendors
- Microsoft
- Malware
- PetitPotamRclone
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 | eb70bd1bb5446e2e46f001 SHA-256 Initial Access python script 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 SHA-256 Initial Access python script Note: IP addresses and |
| sha256 | 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 | tickets. Indicators of compromise (IOC) Indicator Type Role 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 SHA-256 Initial Access Java Script f326201269f1ee2f803ae435 |
| sha256 | f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 | 87a339714043aec0da109f17 SHA-256 Initial Access Java Script f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 SHA-256 Initial Access python script 06c5c14f043aee3bcc5843 |
From the original article
2 min read at gbhackers.com
Hackers impersonated IT help desk personnel on Microsoft Teams to gain remote access and abuse Active Directory Certificate Services (AD CS), turning approved support sessions into privileged authentication paths. Microsoft disclosed two intrusions on October 30, 2026, involving certificate template abuse and NTLM relay. The attacks did not exploit a Teams vulnerability.
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.