Attackers posing as IT support on Microsoft Teams turned user-approved remote sessions into access to enterprise authentication systems in two intrusions investigated by Microsoft Threat Intelligence. Its October 30 report describes how insecure certificate configurations enabled the attacks, with one intrusion progressing to data theft despite automated containment.
The findings concern organizations running Active Directory Certificate Services (AD CS), Microsoft’s infrastructure for issuing digital certificates. Separate disclosures detail Apple spyware warnings received by German lawmakers and public figures, and the extradition of a Canadian man accused of hacking US university computers to mine cryptocurrency.
From a support call to privileged authentication
Microsoft investigated two human-operated intrusions that began with Teams messages and calls impersonating help desk personnel. The attackers persuaded users to approve remote access, primarily by opening Quick Assist and supplying a connection code. Across the broader activity, organization-themed onmicrosoft.com tenant names and support-related display names helped external contacts appear familiar.
The attacks relied on social engineering and insecure or overly permissive AD CS settings, rather than a vulnerability in Teams. Microsoft did not attribute the activity to a specific threat actor.
After gaining control, attackers placed an archive in the user’s Downloads folder, extracted it into a newly created, KB-prefixed directory under the user profile and launched scripts through portable Python, Bun or Java runtimes. Bun is a JavaScript runtime; in one variant, its executable had been renamed but retained its original version metadata. Another variant used a portable Java runtime to execute a Java source file.
The scripts checked Windows versions, network settings and running processes, then assessed certificate services. The compromised workstation also connected to domain infrastructure through LDAPS, an encrypted directory-access protocol, and SMB, used for Windows file sharing and other network operations.
The two intrusions then diverged:
- Case 1 used ESC1 certificate-template abuse. A misconfigured template allowed a low-privileged requester to supply another identity and obtain authentication certificates for privileged accounts. The attacker performed DCSync, which abuses directory replication to obtain credential data. Microsoft said Defender’s automated attack disruption restricted covered identities and blocked substantial follow-on activity, but a privileged identity excluded from containment remained usable and later supported data exfiltration.
- Case 2 used ESC8 authentication relay. The attacker used PetitPotam to make a domain controller authenticate to an attacker-controlled system, then forwarded that NTLM authentication to AD CS Web Enrollment, a certificate-request interface lacking relay protections. The attacker obtained a certificate for the domain-controller account and used PKINIT, certificate-based Kerberos authentication. After Defender generated ESC8-related alerts, the customer isolated the associated workstation; Microsoft observed no further progression.
An issued authentication certificate can remain useful independently of the initially compromised password. Resetting that password or reimaging the first workstation does not revoke the certificate or invalidate Kerberos authentication tickets already issued.
What enterprise defenders can investigate
Microsoft advises investigators to connect the remote-support session with subsequent process, network, identity and certificate activity. A filename or the presence of Java or Bun alone is weak evidence. A stronger pattern is a portable runtime executing scripts from a newly created, user-writable directory immediately after an unauthorized remote session, followed by discovery commands or connections to identity infrastructure.
Its published hunting queries use seven-day windows to look for external Teams chats and available impersonation signals; Bun or Java executing .js or .java files from AppData\Roaming\KB directories followed by digits; and connections from those staged runtimes to ports 80, 445, 636 and 88. Other queries join NTLM relay, Certificate Services, PKINIT and Kerberos-ticket alerts with their supporting evidence.
Defender coverage includes suspicious external Teams activity, script execution, AD CS enumeration and certificate requests, ESC1 and ESC8 abuse, NTLM relay, certificate-based Kerberos authentication and DCSync. Microsoft says alert availability depends on configuration and enabled sensors. Investigators should validate available fields, tune searches for legitimate activity and correlate results; a single match is an investigation lead.
Microsoft also published three SHA-256 file fingerprints:
- Initial-access JavaScript:
85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 - Initial-access Python script:
f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 - Initial-access Python script:
06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7
For response teams, the first case illustrates the practical consequence of containment exclusions: automated disruption can leave an attacker’s access intact when a compromised privileged identity is outside its scope.
Canadian defendant extradited in university mining case
In a separate November 3 announcement, the US Attorney’s Office for the Western District of New York said Ryan James Roach, 35, of Saskatchewan, had been extradited from Canada on October 28. Roach and Mathiew James Stubbings, 41, of Ontario, face charges concerning an alleged scheme to steal credentials and use university computing resources to mine cryptocurrency between June 2016 and December 2019.
The indictment alleges that the defendants targeted educational institutions with supercomputers in New York, Tennessee, North Carolina and Massachusetts. They allegedly researched network vulnerabilities, deployed malware, stole login credentials and transferred them to servers they controlled, while forcing victim computers to mine cryptocurrency for their benefit.
Prosecutors say virtual private servers in multiple countries, registered under false names, distributed malware and mining software and stored stolen credentials. The defendants allegedly also used compromised computers belonging to another victim to conceal their identities, then conducted reconnaissance and expanded access inside networks. The indictment alleges damage to at least 10 protected computers within a one-year period and losses of at least $5,000, including damage at a higher-education institution in western New York.
The charges cover conspiracy to obtain information from and damage protected computers, obtaining information from protected computers, and intentional damage to protected computers. The announcement lists a maximum penalty of 10 years in prison and a $250,000 fine. Both defendants are presumed innocent unless proven guilty.
Roach was arraigned and held pending a detention hearing scheduled for November 3. Extradition proceedings for Stubbings remained underway in Canada. The case followed an FBI and Justice Department Computer Crime and Intellectual Property Section investigation, with the department’s Office of International Affairs assisting Roach’s arrest and extradition.
German lawmakers receive Apple spyware warnings
Germany’s Federal Office for Information Security, BSI, said several Bundestag members and other public figures had received Apple threat notifications since October 29. The alerts concern mercenary spyware: commercially developed surveillance software historically used frequently on behalf of state actors against selected individuals.
BSI says Apple describes the notifications as highly reliable warnings of targeting, although they do not establish whether an attack succeeded. The agency recommends that recipients assume their devices may be compromised, particularly if they have noticed unusual crashes or rapid battery drain. It alerted Bundestag members in an October 30 letter and asked affected people to contact it directly.
Spyware of this kind can infect a device without user interaction—for example, through a specially crafted message that need not be opened, known as a zero-click attack. Pegasus from NSO Group is a prominent example of this software category. On a compromised device, attackers can access messages, including those in encrypted messaging services, calls, contacts, calendars and location, and activate the microphone and camera.
BSI says genuine notifications appear on the iPhone lock screen and in Settings, arrive by email at Apple Account addresses, and appear at the top of the account page after sign-in. Apple does not ask recipients to follow links, open files, install apps or profiles, or disclose passwords or verification codes. Anyone unsure of authenticity should enter account.apple.com directly in a browser.
Recipients should immediately update the operating system unless a forensic examination is planned. BSI also recommends considering Lockdown Mode, available through Settings > Privacy & Security > Lockdown Mode, then enabling it and restarting. Keep it enabled, including on a replacement device, and install future updates promptly. It makes new attacks harder but does not remove an existing infection. It restricts some attachments, link previews and FaceTime calls from unknown people; ordinary calls and basic text messages continue to work.
People who judge the compromise risk high should consider replacing the device, resetting accounts used on it and changing their phone number. BSI’s further steps are to:
- Set a different device passcode; Face ID and Touch ID do not replace it.
- Change Apple Account, email and other account passwords, and enable two-factor authentication where absent.
- Add a new trusted phone number before removing the old one, and set up authenticator apps afresh with each service rather than transferring them from the previous device.
- Enable Signal’s registration lock and WhatsApp’s two-step verification with new credentials, then review linked devices in both services and the Apple Account, removing unrecognized entries.
BSI asks notification recipients to report them to [email protected] so it can assess the scale and provide assistance.
