Attackers have been impersonating IT support staff on Microsoft Teams to gain remote access to company computers. After convincing employees to share control via Windows Quick Assist, the attackers deployed malicious scripts and exploited weaknesses in Active Directory Certificate Services to obtain login certificates for privileged accounts, including domain controllers. Microsoft investigated two such intrusions, with one resulting in the theft of company data copied to an external server.
The attacks exploited no flaw in Teams itself but rather relied on social engineering and misconfigured certificate systems. Microsoft recommends that organizations verify unexpected support requests through known internal channels, restrict outside Teams access, review certificate templates for security weaknesses, enable additional authentication protections on enrollment endpoints, and ensure all privileged accounts are included in automatic containment responses. The techniques used, while not new, highlight the importance of proper configuration and swift incident response.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
