Attackers posing as IT support on **Microsoft Teams** have successfully tricked employees into granting them remote control of their PCs. This initial access then allowed them to exploit insecure **Active Directory Certificate Services (AD CS)** settings to acquire login certificates for privileged accounts, including those for domain controllers. **Microsoft** reported on two such intrusions, one of which culminated in the exfiltration of company data to an external server. Notably, these attacks did not exploit any flaw within **Teams** itself but relied heavily on social engineering and existing AD CS misconfigurations. **Microsoft** has not attributed this activity to any known threat group. ### The Anatomy of the Attack Both incidents followed an identical pattern, according to **Microsoft**. Attackers initiated contact with employees through **Teams**, using messages and calls, while impersonating the company's internal IT or help desk. They operated from external tenants with support-themed names, designed to appear legitimate to the unsuspecting user.  The social engineering aspect persuaded users to open **Quick Assist**, a built-in Windows remote-help tool, and provide the connection code. This granted the attackers direct, hands-on control over the victim's workstation.  From there, the attackers would drop an archive into the Downloads folder, unpack it into a folder named to mimic a Windows update, and execute its contents using a portable **Python**, **Bun**, or **Java** runtime. File names alone proved to be an unreliable indicator, as some were renamed while still retaining original runtime version details. ### The Power of a Stolen Certificate **AD CS** is a critical Windows role responsible for issuing certificates used for user and computer authentication. A misconfigured certificate template can allow an attacker who holds such a certificate to impersonate the named account. **Microsoft** emphasized that these certificates remain valid even after an account's password is reset or the initial compromised machine is wiped, thus preserving attacker access. ### Case 1: Privileged Certificates and Containment Gaps In the first intrusion, attackers exploited a certificate template vulnerability known as **ESC1**. This flaw permits a low-privileged user to request a certificate that impersonates a privileged account. The initial wave of calls targeted three users, yielding certificates for three highly privileged accounts. While **Microsoft Defender's** automatic attack disruption successfully terminated these identities and their active sessions, one privileged account was inadvertently excluded from the automated response, remaining exploitable. Approximately 90 minutes later, a second, larger wave targeted 16 users and a second workstation, resulting in certificates for eight more privileged accounts. Over 1,000 subsequent attempts to access files via **SMB** or log in were successfully blocked. Within seconds of obtaining a certificate, the attacker logged into a domain controller and executed **DCSync**, a tool used to copy password data from **Active Directory**. Although containment measures were swiftly enacted, limiting the amount of data replicated, **Microsoft** did not disclose the exact volume of credential data obtained. The excluded account proved to be the critical foothold. The attacker continued to use it to access a file server and utilized a renamed copy of **Rclone** to exfiltrate data from a shared drive to an external **SFTP** server. The quantity of data stolen was not specified.  This case underscores **Microsoft's** warning that "partial identity containment can reduce attack activity while still leaving a viable privileged route." ### Case 2: Domain Controller Certificate Acquisition The second intrusion began similarly but diverged due to the absence of the **ESC1** template weakness. Instead, the attacker employed a technique known as **PetitPotam** to coerce a domain controller into authenticating to an attacker-controlled machine. This **NTLM** login was then relayed to the **AD CS** web enrollment page, a vulnerability known as **ESC8**, circumventing the need for a password. The attacker used this relayed login to request a certificate for the domain controller itself. With this certificate and **Kerberos (PKINIT)**, the attacker obtained a ticket-granting ticket for the domain controller, transforming a transient relayed login into persistent access. In this instance, the response was effective. **Defender** triggered **ESC8** alerts, the customer isolated the compromised workstation, and **Microsoft** confirmed no further malicious activity. The key differentiator between the two cases was the effectiveness of containment: partial in the first, leading to data exfiltration, and complete in the second, stopping the attack. ### Defensive Strategies for IT Security Professionals Since these attacks exploit configuration and human vulnerabilities rather than software flaws, there are no patches. **Microsoft's** recommendations focus on robust configuration and incident response: * **Employee Training & Verification**: Employees must be trained to verify any unexpected support request through a known, internal channel before sharing screens or granting remote control. Organizations should limit which external **Teams** tenants can communicate with employees and restrict remote-support tools to approved options only. * **AD CS Template Review**: Regularly audit sign-in certificate templates for **ESC1**-like weaknesses (allowing requesters to name accounts) or excessive enrollment permissions. Revoke unnecessary enrollment rights. * **Secure AD CS Endpoints**: Mandate **HTTPS** and enable **Extended Protection for Authentication (EPA)** on web enrollment endpoints. Disable **NTLM** where possible. **Microsoft's** [KB5005413](https://support.microsoft.com/en-us/topic/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429) provides guidance, and **Defender for Identity** posture checks can identify templates and endpoints vulnerable to **ESC1** and **ESC8**. * **Certificate Auditing**: Enable comprehensive certificate auditing. If a malicious certificate is issued, revoke it immediately. Remember that revocation does not automatically cancel existing **Kerberos** tickets; active tickets must be reviewed separately. * **Containment Protocol**: Treat any account excluded from automatic containment as a critical oversight requiring immediate manual intervention. ### What We Know and Don't Know **Microsoft** has not attributed these intrusions to a specific threat actor group nor provided exact dates for the incidents. The techniques employed are not novel; researchers identified **ESC1** and **ESC8** certificate weaknesses in 2021, and the **PetitPotam** coercion trick was disclosed the same year. **Microsoft** itself documented the **Teams** help-desk-to-remote-access entry method earlier in 2026. This report's significance lies in demonstrating the real-world convergence of these techniques and highlighting the critical lesson of incomplete account containment. Newer Windows versions offer improved protection against the **ESC8** step. **Microsoft** enabled **EPA** by default for **AD CS** in **Windows Server 2025**, whereas **Server 2022** and **2019** require manual activation. ### Indicators and Detections **Microsoft's** report details **Defender** alerts across **Teams**, endpoints, and identity signals. It also provides four advanced hunting queries as "starting points for investigation." Additionally, three **SHA-256** file hashes associated with the initial-access scripts were published: * **SHA-256**: `85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17` (JavaScript initial-access script) * **SHA-256**: `f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001` (Python initial-access script) * **SHA-256**: `06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7` (Python initial-access script)