Attackers masqueraded as IT support on Microsoft Teams, tricking employees into granting them remote access to their PCs. They then exploited insecure Active Directory Certificate Services (AD CS) configurations to obtain login certificates for privileged accounts, including one for a domain controller. From there, the attacker dropped an archive into the Downloads folder, unpacked it into a new folder that mimicked a Windows update, and ran its contents using a portable Python, Bun, or Java runtime.
This case underscores Microsoft's stance that "partial identity containment can minimize attack activity while preserving a viable privileged access route." The second breach started similarly, but veered off course due to a missing template weakness. Staff must verify all unexpected support requests through a designated internal communication channel before sharing a screen or granting remote control access.
Microsoft has enabled the EPA (Endpoint Detection and Response) feature automatically for AD CS on Windows Server 2025, whereas manual activation is necessary for Windows Server 2022 and 2019. Microsoft's report includes alerts from Defender across Teams, endpoints, and identity signals, and four advanced hunting queries that are described as starting points for investigation rather than definitive proof.
It also released three file hashes associated with the initial-access scripts: SHA-256 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 (JavaScript initial-access script), SHA-256 f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 (Python initial-access script), and SHA-256 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 (Python initial-access script).
