Attackers Posed as IT Support on Microsoft Teams and Abused AD CS to Steal Company Data

Attackers posed as the company’s IT or help desk on Microsoft Teams and persuaded employees to give them remote control of their computers through Quick Assist. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged accounts, including a domain controller. Microsoft investigated two intrusions; in one, company data was copied to an external server. Microsoft did not attribute the activity to any known group.