Microsoft Threat Intelligence investigated two human-operated intrusions in which attackers messaged and called employees on Teams while posing as the company's own IT or help desk, talked them into reading back a Quick Assist connection code, and took direct remote control of the workstation. From there they staged portable Python, Bun or Java runtimes, performed host and network discovery, and pivoted to Active Directory Certificate Services: in one case they abused an ESC1-vulnerable certificate template to request authentication certificates for highly privileged accounts and ran DCSync, and relayed the domain controller's NTLM authentication to AD CS Web Enrollment (ESC8) for a domain-controller certificate used with PKINIT. Microsoft notes such certificates survive password resets and device wipes, and that one intrusion ended with company data copied to an external server — Defender's automatic attack disruption cut the other short. No Teams vulnerability was exploited, and the activity is not attributed to a known group; the chain is a reminder that a user-approved remote session plus insecure AD CS configurations can become certificate-backed access to privileged identities.

• Source article