Attackers posing as IT support on Teams abuse Quick Assist and AD CS (ESC1/ESC8) to steal privileged certificates and exfiltrate data

Linha do tempo

1. thehackernews.com ↗ · pub. 02/11/2026 08:08 · coletado 02/11 10:00 primeiro registro

   Attackers posing as IT support on Teams abuse Quick Assist and AD CS (ESC1/ESC8) to steal privileged certificates and exfiltrate data

   ler a análise desta fonte ocultar

   Microsoft investigated two intrusions in which attackers posing as internal IT/help desk contacted employees via Microsoft Teams from external tenants and persuaded them to open Quick Assist, giving hands-on control of the workstation. The attackers then abused insecure Active Directory Certificate Services (AD CS) configurations to obtain login certificates for privileged accounts, including a domain controller. One intrusion ended with data copied to an external SFTP server. No Teams flaw was exploited, Microsoft did not attribute the activity to any named group, and it gave no dates.

   Technical Details

   • Initial access: Teams messages and calls from support-themed external tenants; the victim opens Quick Assist and reads back the code. The attacker drops an archive into Downloads, extracts it into a folder named to resemble a Windows update, and runs the contents with a portable Python, Bun or Java runtime. One copy was renamed while retaining the real runtime's version details.
   • Case 1 (ESC1): A vulnerable certificate template let the requester name the account. The first wave hit 3 users and 1 workstation and yielded certificates for 3 highly privileged accounts. About 90 minutes later a second wave hit 16 users and a second workstation, yielding 8 more. Defender automatic attack disruption cut off the identities, and more than 1,000 later SMB/login attempts were blocked. The attacker signed in to a domain controller within seconds and ran DCSync, but containment limited replication. One privileged account excluded from automatic response stayed usable, and the attacker used it to reach a file server and run a renamed Rclone to exfiltrate share data to an external SFTP server. The volume of data stolen was not stated.
   • Case 2 (ESC8): Without the ESC1 weakness, the attacker used PetitPotam to coerce a domain controller to authenticate to an attacker-controlled machine. The NTLM login was relayed to the AD CS web enrollment page (ESC8) to obtain a domain controller certificate, then PKINIT was used to obtain a TGT. Defender raised ESC8 alerts, the customer isolated the workstation, and no further activity followed.
   • Certificates remain valid after password resets or wiping the first machine. The ESC1/ESC8 weaknesses and PetitPotam date to 2021. EPA is on by default for AD CS in Windows Server 2025 but must be enabled manually on 2022 and 2019.
   • Hashes (SHA-256): 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 (JavaScript initial-access script); f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 and 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 (Python initial-access scripts).

   Remediation

   • There is no patch; this is a configuration issue.
   • Verify unexpected support requests through a known internal channel before sharing a screen or granting remote control.
   • Restrict external Teams tenants and allow only approved remote-support tools.
   • Review certificate templates that let requesters name the account or that too many users can enroll in, and remove unneeded enrollment rights.
   • Require HTTPS and enable Extended Protection for Authentication on web enrollment endpoints, and disable NTLM there where possible (KB5005413).
   • Enable certificate auditing and revoke bad certificates, and review issued Kerberos tickets separately.
   • Treat any account excluded from automatic containment as a deliberate decision and assign a manual response action.