Attackers combined Microsoft Teams social engineering with Quick Assist and AD CS misconfigurations (such as ESC1 and ESC8) to obtain privileged certificates.
Without a software patch available, security relies on configuration hardening and restricting external tenants.
According to a Microsoft report, the attackers did not exploit any technical issues or vulnerabilities in the Teams application itself. Instead, they relied on people being tricked and misconfigured in companies' identity and certificate management systems.
How the attacks started
The attackers contacted employees via Teams messages and calls, posing as internal technical support. They used external accounts with support-related names to appear familiar to the victims.
They then convinced users to open a built-in Windows remote assistance tool and read them the login password. This gave them immediate and complete control of the employee's computer. They then installed files and programs that allowed them to proceed with the next steps of the attack.
How they used the certificates
Microsoft has investigated two similar attacks, without linking them to any specific known group or disclosing dates. In the first case, the attackers identified a vulnerable setting in the system's certificates that allowed ordinary users to request administrator permissions. This allowed them to gain access to important accounts and copy company data to an external server, even though automated defenses blocked many of their attempts.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
New Windows program uses artificial intelligence to evaluate victims' stolen data
↗
In the second case, because this setting was not present, the attackers used a different technique by forcing the company's central server to authenticate itself to a computer they controlled. This allowed them to request a certificate for the central server itself. In this case, immediate system isolation stopped further action.
What does it mean for corporate security?
Since this is not a code issue but a misconfiguration issue, there is no automatic update to fix the issue. Protection is based on changes to settings, restricting external accounts in Teams, and enabling additional security measures in authentication services.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)