SentinelOne Week 45 roundup: Europol dismantles investment-fraud crime-as-a-service network, Teams help-desk impersonation leads to AD CS abuse, second wave of refrigeration attacks hits European supermarkets

Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗

Linha do tempo

1. sentinelone.com ↗ · pub. 06/11/2026 15:30 · coletado 06/11 17:00 primeiro registro só resumo do feed

   SentinelOne Week 45 roundup: Europol dismantles investment-fraud crime-as-a-service network, Teams help-desk impersonation leads to AD CS abuse, second wave of refrigeration attacks hits European supermarkets

   ler a análise desta fonte ocultar

   SentinelOne's weekly Good, Bad and Ugly bulletin for week 45 of 2026 covers three stories: an international law-enforcement operation against investment-fraud infrastructure, social-engineering intrusions that abuse Microsoft Teams and Active Directory Certificate Services (AD CS), and a new round of cyberattacks on supermarket refrigeration systems in Europe. On the enforcement side, authorities supported by Eurojust and Europol shut down over 100 servers and arrested seven suspects behind a scheme that used seemingly legitimate online trading platforms to lure victims, with estimated losses above EUR 4 million (eurojust.europa.eu). On the intrusion side, Microsoft Threat Intelligence described two human-operated cases in which attackers posing as IT support on Microsoft Teams talked employees into granting remote control of their PCs, then used insecurely configured AD CS to obtain logon certificates for privileged accounts, including one for a domain controller (thehackernews.com). On the disruption side, attackers remotely changed refrigeration control settings at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday 2 November, warming fridges and freezers and forcing chains to discard or withdraw chilled and frozen food (thehackernews.com), three weeks after a comparable campaign against French retailers. No CVE is attached to any of the three items and no actor has been named.

   Technical Details

   Teams/AD CS intrusions. The attackers exploited no flaw in Teams itself; they relied on social engineering and on insecurely configured AD CS, and Microsoft did not tie the activity to any known group. The operators messaged and called employees from outside tenants with support-themed names, then talked users into opening Quick Assist and reading back the connection code, giving hands-on control of the workstation. Tooling was unpacked into a folder named to resemble a Windows update and run with a portable Python, Bun or Java runtime. In the first case the attackers abused an ESC1 template: with such a template the requester names the account the certificate represents, so a low-privileged user can request one standing in for a privileged account; a first wave against three users produced certificates for three highly privileged accounts, Defender's automatic attack disruption cut those identities off, but one privileged account had been excluded from the automatic response and stayed usable, and about 90 minutes later a larger wave against 16 users produced certificates for 8 more privileged accounts. The attacker signed in to a domain controller and ran DCSync within seconds of obtaining a certificate, and used the excluded account to reach a file server and run a renamed copy of Rclone to move data to an external SFTP server. The second case used coercion instead: PetitPotam forced a domain controller to authenticate to an attacker-controlled machine, and that NTLM logon was relayed to the AD CS web enrollment page (ESC8) to request a certificate for the domain controller itself, then converted via PKINIT into a ticket-granting ticket; isolation of the workstation stopped the activity. Microsoft notes that a certificate keeps working after a password reset or machine wipe, and that ESC1, ESC8 and PetitPotam were all publicly documented in 2021 (thehackernews.com).

   Refrigeration attacks. Refrigeration controllers are internet-connectable computers that let contractors monitor and repair store systems remotely. In Belgium attackers switched cooling units into defrost mode, which heated the units instead of cooling them, according to the CEO of refrigeration contractor Sabcobel, which manages systems for Delhaize; elsewhere the temperature setpoint was raised, with an ICA store in Sjöbo, Sweden reporting fridges and freezers set to 50°C and a Selver store in Estonia reporting a freezer set to 50°C that rose only 2-3°C before the issue was resolved in about ten minutes with no product loss. Danfoss confirmed its products were involved, as in the earlier French wave. Affected brands included Delhaize (several dozen stores, Belgium and Luxembourg, described as an "IT incident"), Carrefour Belgium (15 of more than 700), Intermarché (10 to 15), Spar stores under Colruyt Group (5), one IKEA store in Mons, ICA and Coop in Sweden, Musgrave/SuperValu in Ireland (13 of 223) and Selver in Estonia (thehackernews.com). Officials later said refrigeration temperatures were also raised at supermarkets in Germany, Romania and the United Kingdom during the same Monday attacks (aljazeera.com). An earlier bulletin from the same publisher noted that the October intrusion targeted Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration control units, many of them legacy devices no longer receiving vendor security updates (sentinelone.com).

   Fraud takedown. The case began with a 2022 complaint from a German couple unable to withdraw funds from an online platform; the operators promised large short-term profits in cryptocurrency, foreign exchange and stocks, showed inflated gains after a small deposit, then pressured victims into larger transfers before stalling on withdrawals and disappearing. Analysis of evidence from earlier action days exposed a company based in Cyprus and Israel allegedly offering "crime-as-a-service" by supplying fraudulent websites, with suspected client call centres in Albania, Kosovo and North Macedonia; 17 locations were searched, more than 100 servers and other assets were seized, and seven suspects were arrested for surrender or extradition to Germany (eurojust.europa.eu). Europol said potential victims were identified in more than 50 countries (cyberscoop.com).

   Remediation

   For the Teams/AD CS activity, Microsoft stresses that there is no patch because no software flaw was involved, and its guidance concerns configuration and response: verify unexpected support requests through a known internal channel before sharing a screen or handing over remote control, restrict which external Teams tenants can reach employees, and allow only approved remote-support tools; review certificate templates that let the requester name the subject account or that too many users can enroll in, and remove unnecessary enrollment rights; require HTTPS and Extended Protection for Authentication on web enrollment endpoints and disable NTLM there, as covered by KB5005413, using Defender for Identity posture checks to flag ESC1- and ESC8-exposed templates; enable certificate auditing, revoke issued rogue certificates and separately review active Kerberos tickets, since revocation does not cancel them; and treat any account excluded from automatic containment as requiring a manual action (thehackernews.com). For refrigeration operators, Danfoss's security advisories page listed no advisory about the attacks as of 3 November, and the most detailed operator guidance remains the October alert CERTFR-2026-ALE-012 from France's CERT-FR (thehackernews.com). Defenders should remove refrigeration controllers from direct internet exposure, place remote maintenance access behind VPN and MFA, change default credentials and monitor setpoint and defrost-mode changes.