Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data

Summary

Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged accounts, including one for a domain controller. Microsoft said in a report that it investigated two such intrusions, one of which resulted in company

Lotu Radar provides attributed news summaries and links to the original publisher. Full reporting and copyright remain with the source.