Fake IT Help Desk Calls on Teams Led to Full Network Takeover Attempts

Microsoft Threat Intelligence investigated two human-operated intrusions that began the same way. Attackers used Microsoft Teams messages and calls to pose as IT or help desk staff, then persuaded users to grant remote access, mainly through Quick Assist. Once connected, they set up portable Python, Bun or Java runtimes, explored the host and network, and checked Active Directory Certificate Services (AD CS) for ways to sign in using certificates.

The two incidents split at the certificate stage. In the first, the attacker abused a vulnerable certificate template (known as ESC1) to obtain authentication certificates for privileged accounts, then performed DCSync. In the second, the attacker used PetitPotam to make a domain controller authenticate to an attacker-controlled system, relayed that authentication to AD CS Web Enrollment (ESC8), and obtained a certificate for the domain controller account to use for Kerberos authentication. Microsoft stressed that no flaw in Teams was exploited. The attacks relied on social engineering and insecure or overly permissive AD CS configurations. The activity was not attributed to a specific threat actor.

The outcomes differed. In the first case, Microsoft Defender attack disruption restricted covered identities and blocked much of the follow-on activity, but a privileged identity excluded from automated containment stayed usable and later supported data exfiltration. In the second, Defender raised ESC8-related alerts, the customer isolated the workstation, and no further progression was seen.