Attackers posed as the company help desk on Microsoft Teams, talked employees into opening Quick Assist, and used the remote session to attack Active Directory Certificate Services. Microsoft's threat intelligence team documented two intrusions built this way, one of which ended with company data copied to an external server.
What happened
Both intrusions opened with Teams messages and calls from external tenants named to resemble the victim's own organisation, using support-style display names. No flaw in Teams was involved. The employee granted the remote session.
Once connected, the operator dropped an archive into Downloads, unpacked it into an update-themed folder under the user profile, and started the payload with a portable Python, Bun or Java runtime. The code mapped the host and network, then examined AD CS for a certificate path.
In the first case a certificate template was misconfigured in the ESC1 way: it accepted requester-supplied identity information and was open to broad enrolment. A wave against three users produced certificates for three highly privileged accounts. About 90 minutes after Defender's automated disruption cut that session, a second wave against 16 users produced certificates for eight more privileged accounts. DCSync ran within seconds of a certificate being issued, and one privileged account excluded from automated containment was later used to reach a file server and copy data out with a renamed Rclone binary.
In the second case ESC1 was not available. The attacker used PetitPotam over EFSRPC to make a domain controller authenticate to an attacker-controlled system, relayed that NTLM authentication to AD CS Web Enrolment, and obtained a certificate for the domain controller's machine account plus a Kerberos ticket. Defender alerts led the customer to isolate the workstation and nothing further was observed.
Who is affected
Windows domains running on-premises AD CS with enrolment endpoints reachable from workstations are the exposure. So are tenants that leave external Teams communication open to anyone.
- Organisations with authentication-capable certificate templates that permit requester-supplied subject names or broad enrolment rights (ESC1).
- Organisations exposing AD CS Web Enrolment without HTTPS and Extended Protection for Authentication, or with NTLM still enabled there (ESC8).
- Users who will accept an unsolicited support call and read out a Quick Assist code, which is most of them unless someone has trained them not to.
What to do now
Treat the certificate authority as a top-tier control, not a server admin chore. Resetting a password does not revoke a certificate that has already been issued.
- Review authentication-capable templates for requester-supplied identity and open enrolment, and remove Web Enrolment endpoints you do not need.
- Require HTTPS and Extended Protection for Authentication on enrolment endpoints and disable NTLM there where the estate allows it.
- Enable Certificate Services auditing and alert on certificates issued to privileged accounts from workstations.
- Restrict Teams external access and federation, approve a single remote-support tool, and block portable runtimes launching from user-writable folders.
- If you suspect an intrusion, revoke unauthorised certificates and separately review active Kerberos tickets, because tickets already issued survive revocation.
What this means for South African businesses
Most South African SMEs with a Windows domain have AD CS running because something needed certificates years ago, and almost nobody has revisited the templates since. That is exactly the gap this chain uses: no zero-day, no exotic tooling, just a trusted support conversation and a permissive certificate configuration.
My read is that a mid-sized local business is more exposed to this than to most of the CVEs in this brief, because the attack needs nothing more than a convincing phone manner and a template that has never been reviewed.
Source: Microsoft Security Blog - From help desk impersonation to AD CS abuse
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.