Attackers pose as IT support on Microsoft Teams to abuse AD CS
Original title: Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data
Attackers use social engineering via Microsoft Teams and insecure AD CS to steal company data.
Attackers posed as IT support on Microsoft Teams and convinced employees to grant remote control of PCs using Quick Assist. They then abused insecure Active Directory Certificate Services settings to obtain login certificates for privileged accounts including domain controllers. In one case this led to data being copied to an external server.
Unconfirmed: The intrusions are not attributed to any known threat group.
- Used Quick Assist for remote control
- Exploited ESC1 and ESC8 flaws
- One case involved DCSync and Rclone for data exfiltration
Impact: theft of company data
- 1.verify IT support requests through internal channels
- 2.review AD CS certificate templates
- 3.enable certificate auditing
- Vendors
- Microsoft
- Victims
- Microsoft customers
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 | 70bd1bb5446e2e46f001 (Python initial-access script) SHA-256 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 (Python initial-access script) Found this article interesti |
| sha256 | 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 | ree file hashes tied to the initial-access scripts: SHA-256 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 (JavaScript initial-access script) SHA-256 f326201269f1ee2f |
| sha256 | f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 | 4043aec0da109f17 (JavaScript initial-access script) SHA-256 f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 (Python initial-access script) SHA-256 06c5c14f043aee3bcc58 |
From the original article
5 min read at thehackernews.com
Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged accounts, including one for a domain controller. Microsoft said in a report that it investigated two such intrusions, one of which resulted in company
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.