Hackers use Microsoft Teams messages and calls to gain remote access
Original title: Hackers Using Microsoft Teams Messages and Calls to Trick Users and Gain Remote Access to System
Attackers impersonate IT support via Teams to approve Quick Assist sessions and abuse AD CS for privileged account access.
Two intrusions show attackers posing as help desk staff through Microsoft Teams chats and calls to persuade employees to approve remote control. They combined social engineering with legitimate remote-support tools and weak Active Directory Certificate Services configurations. One incident exploited ESC1 certificate template settings; the other used ESC8 and PetitPotam to obtain a domain controller certificate.
- Two separate Teams-based intrusions documented
- Used Quick Assist for initial remote access
- Obtained certificates for multiple privileged accounts
- Defender blocked over 1,000 SMB access attempts
Impact: remote workstation control and privileged account compromise
- 1.verify unexpected support requests through known internal channel
- 2.restrict external Teams access
- 3.review certificate template permissions
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 | eb70bd1bb5446e2e46f001 SHA-256 Initial-access Python script 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 SHA-256 Initial-access Python script Note: IP addresses and |
| sha256 | 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 | of compromise (IoCs):- Indicator Type Source-described role 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 SHA-256 Initial-access JavaScript f326201269f1ee2f803ae4353 |
| sha256 | f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 | 187a339714043aec0da109f17 SHA-256 Initial-access JavaScript f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 SHA-256 Initial-access Python script 06c5c14f043aee3bcc5843 |
From the original article
3 min read at cybersecuritynews.com
Hackers are using Microsoft Teams messages and voice calls to impersonate IT support staff, persuade employees to approve remote access, and move deeper into corporate networks. Two intrusions investigated by Microsoft show how a seemingly routine help desk conversation can lead to stolen data and access to highly privileged accounts. The attacks did not exploit […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.