EN PT-BR
← Voltar ao feed
high

Fake IT help desk on Teams uses Quick Assist and AD CS ESC1/ESC8 abuse to steal privileged certificates in two intrusions

2 fonte(s) · 2 atualização(ões) · publicado 31/10/2026 05:25 · coletado há 15 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 03/11/2026 00:01; os links antigos trazem para cá.

Fontes: thehackernews.com ↗ gbhackers.com ↗

Microsoft investigated two intrusions in which attackers posing as internal IT help desk staff contacted employees through Microsoft Teams from external tenants. They persuaded victims to start Quick Assist, which gave them hands-on control of the workstation. They then abused insecure Active Directory Certificate Services (AD CS) configurations to obtain authentication certificates for privileged identities, including a domain controller. No Teams vulnerability was exploited, and Microsoft has not attributed the activity to any named threat actor. In the first intrusion (ESC1), the attackers obtained certificates for 11 privileged accounts in two waves, ran DCSync, and exfiltrated file-server data with a renamed Rclone to an external SFTP server. In the second (ESC8), they used PetitPotam and NTLM relay to obtain a domain-controller certificate, but the customer isolated the workstation and no further activity was seen. gbhackers.com dates Microsoft's disclosure to October 30, 2026, while thehackernews.com says Microsoft gave no dates.

Entenda a falha

A vulnerabilidade

There is no CVE and no Teams flaw. The attackers combined social engineering with two known AD CS misconfigurations. ESC1: a certificate template with broad enrollment permissions, requester-supplied identity information and weak issuance controls lets a low-privileged account request authentication certificates for privileged identities. ESC8: AD CS Web Enrollment is not sufficiently protected against NTLM relay. The attacker needs a workstation foothold (a user tricked into starting Quick Assist) and network reach to the domain infrastructure, and gains certificates for privileged users or a domain controller. There is no patch. EPA is on by default for AD CS in Windows Server 2025 but must be enabled manually on Windows Server 2022 and 2019.

Como funciona

The operator contacts an employee on Teams from an external tenant, posing as help desk, and gets them to launch Quick Assist and read out the connection code. From that session they drop an archive, extract it into a KB-prefixed folder, and run portable Python, Bun or Java runtimes that enumerate the host and the certificate services over LDAPS and SMB. In the ESC1 case, the vulnerable template accepts the identity the requester names and issues a certificate for a privileged account, which is used to sign in to a domain controller and run DCSync. In the ESC8 case, PetitPotam over EFSRPC forces a domain controller to authenticate to an attacker machine, the NTLM authentication is relayed to AD CS Web Enrollment, and the resulting domain-controller certificate is used with Kerberos PKINIT to get a TGT for the machine identity.

Por que é vulnerável

For ESC1, the template trusts identity data supplied by the requester and does not restrict who may enroll or enforce enough issuance controls. For ESC8, the Web Enrollment endpoint accepts relayed NTLM authentication because it lacks HTTPS and Extended Protection for Authentication, and NTLM is still enabled. Social engineering supplies the initial access. Certificates stay valid after password resets or a machine wipe, which makes them a durable foothold. In the first intrusion, one privileged account excluded from Defender's automatic containment stayed usable and enabled the data theft. The articles do not say why the misconfigurations went unnoticed. The fix is configuration: review enrollment permissions and templates, enforce HTTPS and EPA, and disable NTLM where feasible.

Como foi descoberta

Microsoft investigated the two intrusions and published a report, with Defender alerts (including ESC8 alerts) and automatic attack disruption catching part of the activity. gbhackers.com dates the disclosure to October 30, 2026, while thehackernews.com says Microsoft gave no dates, so the intrusion dates are unknown. Microsoft did not attribute the activity to any named threat actor, and the victims are not identified. The ESC1 and ESC8 weaknesses and PetitPotam were named and disclosed in 2021, so none of this is new. The articles do not say how the weak configurations were first identified in the victim environments.

Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 00:16.

Detalhes técnicos

  • Initial access: Teams messages and calls came from organization-themed or support-themed external tenants with support-style display names. The victim opened Quick Assist and shared the connection code (gbhackers.com, thehackernews.com).
  • Payload staging: The attacker dropped an archive into Downloads and extracted it into a KB-prefixed folder under the user profile, named to resemble a Windows update. The contents were run with a portable Python, Bun or Java runtime for host discovery and certificate-services assessment, with LDAPS and SMB connections to domain infrastructure. One runtime copy was renamed while keeping the real runtime's version details (gbhackers.com, thehackernews.com).
  • Intrusion 1 (ESC1): A certificate template with broad enrollment permissions, requester-supplied identity information and weak issuance controls let a low-privileged account request certificates for privileged identities. The first wave hit 3 users and 1 workstation and yielded certificates for 3 highly privileged accounts. About 90 minutes after disruption, a second wave hit 16 users and a second workstation and yielded 8 more, for 11 in total.
  • Containment and exfiltration: Microsoft Defender automatic attack disruption cut off the identities and blocked more than 1,000 later SMB file-access attempts and logons. The attacker still signed in to a domain controller and ran DCSync within seconds of obtaining a privileged certificate. One privileged account excluded from automated containment stayed usable and was used to reach a file server and run Rclone (renamed SearchApp.exe per gbhackers.com) to copy share data to an external SFTP destination. The volume stolen was not stated (thehackernews.com).
  • Intrusion 2 (ESC8): Without the ESC1 weakness, the attacker used PetitPotam over EFSRPC to coerce a domain controller into authenticating to an attacker-controlled machine. The NTLM authentication was relayed to insufficiently protected AD CS Web Enrollment to obtain a domain-controller certificate, and Kerberos PKINIT then yielded a TGT for the machine identity. Defender raised ESC8 alerts and the customer isolated the workstation.
  • Persistence of access: Certificates remain valid after password resets or after the first machine is wiped. The ESC1/ESC8 weaknesses and PetitPotam date to 2021 (thehackernews.com). EPA is on by default for AD CS in Windows Server 2025 but must be enabled manually on 2022 and 2019 (thehackernews.com).
  • Hashes (SHA-256), initial-access scripts (thehackernews.com): 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 (JavaScript); f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 and 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 (Python).

Remediação

  • There is no patch; this is a configuration issue (thehackernews.com).
  • Verify unsolicited support requests through a known internal channel before sharing a screen or granting remote control. Restrict external Teams tenants, allow only approved remote-support tools, and control execution of portable runtimes (gbhackers.com, thehackernews.com).
  • Review certificate enrollment permissions and templates. Enforce HTTPS and Extended Protection for Authentication on enrollment endpoints, and disable NTLM where feasible (gbhackers.com).
  • Revoke unauthorized certificates and investigate Kerberos tickets separately, because password resets do not revoke them (gbhackers.com). Both source texts are truncated at this point, so further guidance is not captured.
  • Review accounts excluded from automated containment, since one such exclusion enabled the data theft.

Relatos divergentes

  • Dates: gbhackers.com states Microsoft disclosed the intrusions on October 30, 2026. thehackernews.com (the more recent source) says Microsoft gave no dates, so the intrusion dates themselves remain unknown.
  • DCSync impact: gbhackers.com says the attackers ran DCSync, while thehackernews.com adds that containment limited replication. The extent of credential replication is therefore unclear.

Linha do tempo

  1. thehackernews.com ↗ · pub. 02/11/2026 08:08 · coletado 02/11 10:00

    Attackers posing as IT support on Teams abuse Quick Assist and AD CS (ESC1/ESC8) to steal privileged certificates and exfiltrate data

    ler a análise desta fonte

    Microsoft investigated two intrusions in which attackers posing as internal IT/help desk contacted employees via Microsoft Teams from external tenants and persuaded them to open Quick Assist, giving hands-on control of the workstation. The attackers then abused insecure Active Directory Certificate Services (AD CS) configurations to obtain login certificates for privileged accounts, including a domain controller. One intrusion ended with data copied to an external SFTP server. No Teams flaw was exploited, Microsoft did not attribute the activity to any named group, and it gave no dates.

    Technical Details

    • Initial access: Teams messages and calls from support-themed external tenants; the victim opens Quick Assist and reads back the code. The attacker drops an archive into Downloads, extracts it into a folder named to resemble a Windows update, and runs the contents with a portable Python, Bun or Java runtime. One copy was renamed while retaining the real runtime's version details.
    • Case 1 (ESC1): A vulnerable certificate template let the requester name the account. The first wave hit 3 users and 1 workstation and yielded certificates for 3 highly privileged accounts. About 90 minutes later a second wave hit 16 users and a second workstation, yielding 8 more. Defender automatic attack disruption cut off the identities, and more than 1,000 later SMB/login attempts were blocked. The attacker signed in to a domain controller within seconds and ran DCSync, but containment limited replication. One privileged account excluded from automatic response stayed usable, and the attacker used it to reach a file server and run a renamed Rclone to exfiltrate share data to an external SFTP server. The volume of data stolen was not stated.
    • Case 2 (ESC8): Without the ESC1 weakness, the attacker used PetitPotam to coerce a domain controller to authenticate to an attacker-controlled machine. The NTLM login was relayed to the AD CS web enrollment page (ESC8) to obtain a domain controller certificate, then PKINIT was used to obtain a TGT. Defender raised ESC8 alerts, the customer isolated the workstation, and no further activity followed.
    • Certificates remain valid after password resets or wiping the first machine. The ESC1/ESC8 weaknesses and PetitPotam date to 2021. EPA is on by default for AD CS in Windows Server 2025 but must be enabled manually on 2022 and 2019.
    • Hashes (SHA-256): 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 (JavaScript initial-access script); f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 and 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 (Python initial-access scripts).

    Remediation

    • There is no patch; this is a configuration issue.
    • Verify unexpected support requests through a known internal channel before sharing a screen or granting remote control.
    • Restrict external Teams tenants and allow only approved remote-support tools.
    • Review certificate templates that let requesters name the account or that too many users can enroll in, and remove unneeded enrollment rights.
    • Require HTTPS and enable Extended Protection for Authentication on web enrollment endpoints, and disable NTLM there where possible (KB5005413).
    • Enable certificate auditing and revoke bad certificates, and review issued Kerberos tickets separately.
    • Treat any account excluded from automatic containment as a deliberate decision and assign a manual response action.
  2. gbhackers.com ↗ · pub. 31/10/2026 05:25 · coletado 31/10 07:00 primeiro registro

    Attackers Pose as IT Help Desk on Teams, Abuse AD CS (ESC1, ESC8) for Domain Privilege Escalation in Two Intrusions

    ler a análise desta fonte

    Microsoft disclosed on October 30, 2026 two intrusions in which operators impersonated IT help desk staff over Microsoft Teams, persuaded victims to start Quick Assist, and then abused Active Directory Certificate Services (AD CS) to obtain certificates for privileged identities. No Teams vulnerability was exploited; the activity relied on social engineering and insecure AD CS configurations. Microsoft has not attributed the activity to a specific threat actor. In the first intrusion, the attackers obtained certificates for 11 privileged accounts, performed DCSync, and exfiltrated files with Rclone. In the second, they used PetitPotam and NTLM relay to obtain a domain-controller certificate before the customer isolated the host.

    Technical Details

    • Attackers contacted employees via Teams messages and calls using organization-themed tenant names and support-style display names, then had victims launch Quick Assist and share connection codes.
    • After access, archives were moved to Downloads and payloads extracted into KB-prefixed directories under user profiles. Portable Python, Bun or Java runtimes were launched to perform host discovery and assess certificate services, with LDAPS and SMB connections to domain infrastructure.
    • Intrusion 1 (ESC1): a certificate template with broad enrollment permissions, requester-supplied identity information and weak issuance controls let a low-privileged account request authentication certificates for privileged identities. The first wave targeted 3 users, compromised one workstation and yielded certificates for 3 highly privileged accounts. About 90 minutes after disruption, a second wave targeted 16 users, compromised another workstation and yielded 8 more privileged certificates.
    • Microsoft Defender blocked more than 1,000 subsequent SMB file-access attempts and logons, but the attackers ran DCSync within seconds of getting one privileged certificate. One privileged account excluded from automated containment stayed usable and was used to access a file server and run Rclone renamed SearchApp.exe, copying files to an external SFTP destination.
    • Intrusion 2 (ESC8): attackers used PetitPotam over EFSRPC to coerce domain-controller authentication, relayed the NTLM authentication to insufficiently protected AD CS Web Enrollment, obtained a domain-controller certificate, and used Kerberos PKINIT to get a TGT for the machine identity. The customer isolated the workstation after Defender alerts, and Microsoft observed no further progression.

    Remediation

    • Restrict external Teams access, verify unsolicited support requests, and control execution of portable runtimes.
    • Review certificate enrollment permissions and templates; enforce HTTPS and Extended Protection for Authentication on enrollment endpoints; disable NTLM where feasible.
    • Revoke unauthorized certificates and separately investigate Kerberos tickets: password resets do not revoke issued certificates, and certificate revocation does not invalidate existing tickets.
    • Review accounts excluded from automated containment.