Hackers Pose as IT Help Desk Staff on Microsoft Teams to Exploit Active Directory Certificate Services
In a striking breach of cybersecurity protocols, hackers have reportedly impersonated IT help desk personnel using Microsoft Teams to gain unauthorized remote access to systems and exploit vulnerabilities within Active Directory Certificate Services (AD CS). This was revealed in a disclosure by Microsoft on October 30, 2026, detailing two significant intrusions that showcased how rapidly attackers adapted social engineering tactics to their advantage.
The attacks did not rely on any inherent vulnerabilities within Teams itself. Rather, the perpetrators cleverly combined social engineering techniques with existing weaknesses in AD CS configurations. Such a strategy allowed them to obtain certificates that represented highly privileged users or even domain controllers, effectively turning approved support sessions into pathways for privileged authentication.
While Microsoft has not attributed these intrusions to any specific threat actor, the modus operandi highlights an ongoing trend where sophisticated attackers leverage human psychology alongside technical vulnerabilities to achieve their goals.
The Method of Attack
The initial attack phase involved the hackers contacting employees via Teams messages and calls, masquerading as support staff. They established a false sense of legitimacy by utilizing organization-themed tenant names and support-oriented display names, making victims more susceptible to their manipulations. Once they gained the trust of their targets, the attackers prompted them to launch Quick Assist, a remote desktop sharing tool, and share connection codes.
After acquiring control over the victims’ machines, the attackers executed a series of actions aimed at solidifying their foothold. They moved sensitive archives into Downloads, extracted malicious payloads into directories prefixed with "KB" under user profiles, and initiated portable runtimes such as Python, Bun, or Java. This sequence executed processes crucial for host discovery and the evaluation of certificate services while establishing connections to essential domain infrastructure over LDAPS (LDAP over SSL) and SMB (Server Message Block).
In the course of the first intrusion, the hackers were able to identify a vulnerable certificate template, exploiting factors such as broad enrollment permissions, requester-supplied identity information, and lax issuance controls. This negligence allowed a low-privileged account to request authentication certificates, portraying itself as a privileged user.
The attack initially targeted three users, resulting in the compromise of one workstation and the acquisition of certificates for three high-privileged accounts. Approximately 90 minutes later, a second wave struck, targeting 16 users, compromising another workstation, and netting certificates for an additional eight privileged accounts.
Reacting to the Intrusions
Microsoft Defender intervened to block over 1,000 subsequent SMB file-access attempts, as well as additional logon attempts. However, within seconds of acquiring a privileged certificate, the attackers executed DCSync—a method to replicate and obtain password hashes from domain controllers—before containment methods could effectively take hold.
Alarmingly, one privileged account that had been excluded from automated containment remained functional, allowing attackers to further infiltrate the network. Using this account, they accessed a file server and executed Rclone, masqueraded as SearchApp.exe, to transfer sensitive files to an external SFTP destination.
In the second intrusion, a more technical approach was taken; attackers employed PetitPotam, a tool used to coerce domain-controller authentication over EFSRPC (Encrypting File System Remote Protocol). They relayed the resulting NTLM (NT LAN Manager) authentication to an inadequately secured AD CS Web Enrollment, exploiting further weaknesses in the ESC8 configuration to secure a domain-controller certificate. This enabled the attackers to use Kerberos PKINIT authentication, ultimately receiving a ticket-granting ticket for that machine identity, which put them in an advantageous position for further breaches.
Mitigation Efforts
In response to these alarming breaches, Microsoft has recommended several key measures to enhance security and prevent similar future incidents. These include restricting external access to Teams, carefully verifying unsolicited support requests, controlling the execution of portable runtimes, and critically assessing certificate enrollment permissions. Additionally, they urge organizations to enforce HTTPS and Extended Protection for Authentication on enrollment endpoints, and wherever feasible, to disable NTLM.
As organizations assess their security measures, responders must be vigilant in revoking unauthorized certificates and conducting thorough investigations of Kerberos tickets. Notably, simple password resets do not automatically revoke issued certificates, and revoking certificates does not automatically invalidate existing tickets, highlighting the necessity of a comprehensive security strategy.
As the trend of social engineering-driven cyberattacks continues to challenge organizations, the need for robust training and awareness programs becomes paramount. Security teams must be diligent, proactive, and well-equipped to respond to the quickly evolving landscape of cybersecurity threats that exploit human and technical vulnerabilities alike.