The Microsoft Threat Intelligence team has released a detailed analysis of two large-scale cyber intrusions carried out by human attackers, which rely on deceiving users via social media applications and collaboration platforms such as Microsoft Teams to gain access to enterprise network infrastructure.
The observed incidents began with fraudulent messages and calls impersonating technical support or Help Desk staff, using advanced social engineering to convince users to grant interactive remote access permissions, often via the Quick Assist tool. Once the connection was established, the attackers proceeded to deploy portable runtime environments such as Python, Bun, or Java, conduct device and network reconnaissance, and evaluate Active Directory Certificate Services (AD CS) to search for certificate-based authentication paths.
Divergent Attack Paths via the Certificate Layer
Despite the identical initial access phase, the attacks branched into two main paths at the certificate layer:
- Case 1 (ESC1): The attackers exploited a certificate template vulnerable to the ESC1 security misconfiguration to obtain authentication certificates for highly privileged accounts and execute a DCSync operation.
- Case 2 (ESC8): The attackers used the PetitPotam technique to force the domain controller to authenticate with a system controlled by the attacker, then relayed the domain controller's NTLM authentication to the AD CS Web Enrollment service, extracting a certificate for the domain controller account and using it for Kerberos authentication (PKINIT).
Why This News Matters
The danger of these attack patterns lies in their ability to turn a user-approved remote support session into persistent access backed by authentication tokens for highly privileged entities and the core domain infrastructure. Microsoft noted that the attacks did not exploit software vulnerabilities within Microsoft Teams itself, but relied entirely on deceiving users and overly permissive configuration vulnerabilities in Active Directory Certificate Services.
Proposed Prevention and Investigation Measures
Microsoft offers a set of recommendations for security teams to mitigate these risks, including:
- Mandatory verification of unfamiliar support requests through known internal communication channels before initiating remote control sessions.
- Implementing App Control for Business policies to restrict the execution of portable runtime environments from user-writable folders.
- Reviewing and securing Active Directory Certificate Services settings and applying mitigation guidance against NTLM Relay attacks according to official Microsoft documentation (KB5005413).
- Enabling advanced auditing for certificate services and monitoring for unauthorized login and certificate events.