Microsoft Teams'da IT yordami sifatida o'zini ko'rsatgan hujumchilar xodimlarni o'z kompyuterlariga masofadan kirish huquqini berishga ko'ndirgan. So'ngra ular zaif sozlangan Active Directory Certificate Services (AD CS) sozlamalaridan foydalanib, imtiyozli hisoblar, jumladan domen nazoratchisi (domain controller) uchun kirish sertifikatlarini olgan.
Microsoft hisobotida aytilishicha, u ikki shunday hujumni tekshirgan, ulardan biri natijasida kompaniya ma'lumotlari tashqi serverga nusxalangan.
Hujumchilar Teams'da hech qanday zaiflikdan foydalanmagan. Ular ijtimoiy muhandislik (social engineering) va zaif sozlangan AD CS'ga tayangan, Microsoft esa bu faoliyatni hech qanday ma'lum guruh bilan bog'lamagan.
Hujumlar qanday boshlangan
Har ikkala hujum bir xil tarzda boshlangan, deb aytgan Microsoft. Hujumchilar xodimlarga Teams orqali xabar yuborib va qo'ng'iroq qilib, o'zlarini kompaniyaning IT yoki yordam xizmati sifatida ko'rsatgan. Ular tashqi tenantlardan (outside tenants) yordam mavzusidagi nomlar bilan ishlagan, shuning uchun aloqa tanish ko'ringan.
Ular har bir foydalanuvchini Windows'ga o'rnatilgan masofadan yordam vositasi — Quick Assist'ni ochishga va ulanish kodini o'qib berishga ko'ndirgan. Bu hujumchiga ish stantsiyasiga to'g'ridan-to'g'ri, qo'lda nazorat qilish imkonini bergan.
Shu yerdan hujumchi arxivni Downloads (Yuklamalar) jildiga tashlagan, uni Windows yangilanishiga o'xshash nom bilan yangi jildga ochgan va uning mazmunini ko'chma Python, Bun yoki Java ish vaqti (runtime) bilan ishga tushirgan. Fayl nomlari zaif signal bo'lgan, chunki bir nusxa haqiqiy ish vaqti versiya tafsilotlarini saqlab qolgan holda qayta nomlangan.
Sertifikat hujumchiga nima beradi
AD CS — bu Windows roli bo'lib, foydalanuvchilar va kompyuterlar tizimga kirishda taqdim etadigan sertifikatlarni chiqaradi. Zaif sozlangan shablondan olingan sertifikat uni ushlab turgan shaxsga sertifikat nomidagi hisob sifatida tizimga kirish imkonini beradi.
Microsoft aytishicha, bunday sertifikat hisob paroli qayta o'rnatilgandan yoki birinchi mashina tozalangandan keyin ham ishlashda davom etadi, shuning uchun bu qadamlar hujumchining kirishini to'xtatmaydi.
1-holat: Imtiyozli sertifikatlar va cheklashdagi bo'shliq
Birinchi hujumda hujumchilar ESC1 deb nomlanuvchi zaiflikka ega sertifikat shablonini topgan. Bunday shablon bilan so'rovchi sertifikat qaysi hisobni ifodalashini o'zi belgilashi mumkin, shuning uchun past imtiyozli foydalanuvchi imtiyozli hisob uchun sertifikat so'rashi mumkin.
Birinchi to'lqin uch foydalanuvchi va bitta ish stantsiyasiga qaratilgan bo'lib, uchta yuqori imtiyozli hisob uchun sertifikatlar ishlab chiqarilgan. Microsoft Defender'ning avtomatik hujumni to'xtatish (automatic attack disruption) funksiyasi bu identifikatorlarni uzib qo'ygan va ularning faol sessiyalarini tugatgan. Biroq bitta imtiyozli hisob avtomatik javobdan chetda qolgan, shuning uchun u ishlatilishi mumkin bo'lib qolgan.
Taxminan 90 daqiqa o'tgach, kattaroq to'lqin 16 foydalanuvchi va ikkinchi ish stantsiyasiga urilgan, natijada yana 8 ta imtiyozli hisob uchun sertifikatlar ishlab chiqarilgan. Microsoft aytishicha, keyinchalik SMB orqali fayllarga kirish yoki tizimga kirish bo'yicha 1000 dan ortiq urinishlar bloklangan.
Sertifikat olinganidan bir necha soniya ichida hujumchi domen nazoratchisiga kirgan va DCSync — Active Directory'dan parol ma'lumotlarini nusxalash vositasini ishga tushirgan. Operatsiya cheklash (containment) amal qilgan paytda allaqachon boshlangan edi, bu esa nusxalanishi mumkin bo'lgan ma'lumot hajmini cheklagan. Microsoft hujumchi qancha hisob ma'lumotini olganini aytmagan.
Chetda qolgan hisob ochiq eshik bo'lgan. Hujumchi uni ishlatishda davom etgan, fayl serveriga yetib borgan va fayl nusxalash vositasi Rclone'ning qayta nomlangan nusxasini ishga tushirib, ma'lumotlarni ulushdan (share) tashqi SFTP serverga ko'chirgan. Microsoft qancha ma'lumot olinganini aytmagan.
Bu holat Microsoft so'zlari bilan aytganda, "qisman identifikator cheklashi hujum faoliyatini kamaytirishi mumkin, ammo hali ham ishlaydigan imtiyozli yo'lni ochiq qoldiradi".
2-holat: Domen nazoratchisi uchun sertifikat
Ikkinchi hujum xuddi shu tarzda boshlangan, ammo shablon zaifligi yo'qligi sababli boshqa yo'nalish olgan. Hujumchi PetitPotam deb nomlanuvchi usuldan foydalanib, domen nazoratchisini hujumchi nazoratidagi mashinaga autentifikatsiya qilishga majbur qilgan.
Bu NTLM kirishi AD CS veb ro'yxatga olish (web enrollment) sahifasiga yo'naltirilgan — bu ESC8 deb nomlanuvchi suiiste'mol, parol talab qilinmagan. Hujumchi yo'naltirilgan kirishdan foydalanib, domen nazoratchisining o'zi uchun sertifikat so'ragan. Bu sertifikat va Kerberos (PKINIT) bilan hujumchi domen nazoratchisi uchun chipta beruvchi chipta (ticket-granting ticket) olgan, bu esa bir martalik yo'naltirilgan kirishni doimiy identifikatorga aylantirgan.
Bu yerda javob ishlagan. Defender ESC8 ogohlantirishlarini ko'targan, mijoz ish stantsiyasini izolyatsiya qilgan va Microsoft aytishicha, keyinchalik hech qanday faoliyat kuzatilmagan.
Ikki holat o'rtasidagi farq cheklashda bo'lgan. Birinchisida avtomatik to'xtatish ko'pchilik hujumni bloklagan, ammo chetda qolgan bitta hisob ochiq qolgan. Ikkinchisida bitta ish stantsiyasini izolyatsiya qilish uni to'xtatgan.
Himoyachilar nima qilishi mumkin
Bu yerda hech qanday yamoq (patch) yo'q, chunki hech narsa dasturiy zaiflik emas. Microsoftning maslahati sozlash va javob haqida.
- Xodimlar har qanday kutilmagan yordam so'rovini tanish ichki kanal orqali tasdiqlasin, ekranni ulashish yoki masofadan nazorat berishdan oldin. Tashqi Teams tenantlarining xodimlarga yetib borishini cheklang va faqat tasdiqlangan masofadan yordam vositalariga ruxsat bering.
- Kirish sertifikati shablonlarini tekshiring — so'rovchi hisobni o'zi belgilashi mumkin bo'lgan yoki juda ko'p foydalanuvchi ro'yxatdan o'tishi mumkin bo'lgan shablonlarni aniqlang va kerak bo'lmagan ro'yxatga olish huquqlarini olib tashlang.
- Veb ro'yxatga olish nuqtalarida HTTPS talab qiling va Autentifikatsiya uchun kengaytirilgan himoya (Extended Protection for Authentication, EPA) ni yoqing, va u yerda NTLM'ni o'chiring, iloji bo'lsa. Microsoftning KB5005413 bu haqida, va Defender for Identity holat tekshiruvlari ESC1 va ESC8'ga ochiq shablonlar va nuqtalarni belgilaydi.
- Sertifikat auditini yoqing. Agar yomon sertifikat chiqarilgan bo'lsa, uni bekor qiling (revoke), ammo bekor qilish allaqachon chiqarilgan Kerberos chiptalarini bekor qilmasligini unutmang; faol chiptalarni alohida ko'rib chiqing.
- Avtomatik cheklashdan chetda qolgan har qanday hisobni ataylab qilingan qaror sifatida ko'ring va uning o'rniga qo'lda amalni tayinlang.
Nima ma'lum va nima ma'lum emas
Microsoft bu hujumlarni hech qanday nomlangan guruh bilan bog'lamagan va ular qachon sodir bo'lganini aytmagan.
Usullar yangi emas. Tadqiqotchilar ESC1 va ESC8 sertifikat zaifliklarini 2021-yilda nomlagan, PetitPotam majburlash usuli ham o'sha yili oshkor qilingan. Microsoft o'zi 2026-yil boshida Teams yordam xizmati-dan-masofadan-kirish kirish usulini hujjatlashtirgan.
Bu hisobot qo'shadigan narsa — bu ikki usul haqiqiy hujumlarda uchrashishi, shuningdek chetda qolgan hisob haqidagi saboq.
Yangi Windows ESC8 qadamiga kamroq ochiq. Microsoft Windows Server 2025'da AD CS uchun EPA'ni sukut bo'yicha yoqqan, Server 2022 va 2019 esa uni qo'lda yoqishni talab qiladi.
Ko'rsatkichlar va aniqlashlar
Microsoft hisobotida Teams, nuqtalar va identifikator signallari bo'yicha Defender ogohlantirishlari, shuningdek to'rtta ilg'or qidiruv so'rovi (advanced hunting queries) ro'yxati keltirilgan — ular "o'z-o'zidan dalil emas, balki tekshiruv uchun boshlang'ich nuqtalar" deb atalgan. Shuningdek, dastlabki kirish skriptlari bilan bog'liq uchta fayl xesh (hash) e'lon qilingan:
- SHA-256
85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17(JavaScript dastlabki kirish skripti) - SHA-256
f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001(Python dastlabki kirish skripti) - SHA-256
06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7(Python dastlabki kirish skripti)
Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged accounts, including one for a domain controller.
Microsoft said in a report that it investigated two such intrusions, one of which resulted in company data being copied to an external server.
The attackers exploited no flaw in Teams itself. They relied on social engineering and on AD CS that had been set up insecurely, and Microsoft did not tie the activity to any known group.
How the Attacks Began
Both intrusions started the same way, Microsoft said. The attackers messaged and called employees on Teams while posing as the company's own IT or help desk, working from outside tenants with support-themed names so the contact looked familiar.
They talked each user into opening Quick Assist, a remote-help tool built into Windows, and reading the connection code back to them. That gave the attacker direct, hands-on control of the workstation.
From there, the attacker dropped an archive into the Downloads folder, unpacked it into a new folder named to resemble a Windows update, and ran its contents with a portable Python, Bun, or Java runtime. File names alone were a weak signal, because one copy was renamed while still carrying the real runtime's version details.
What a Certificate Buys an Attacker
AD CS is the Windows role that issues the certificates users and computers present when they log in. A certificate from a poorly configured template lets whoever holds it sign in as the account it names.
Microsoft said such a certificate continues to work even after the account's password is reset or the first machine is wiped, so neither step ends the attacker's access.
Case 1: Privileged Certificates, and a Gap in Containment
In the first intrusion, the attackers found a certificate template with a weakness known as ESC1. With that kind of template, the requester can name the account the certificate will represent, so a low-privileged user can request one that stands in for a privileged account.
The first wave of calls targeted three users and one workstation, producing certificates for three highly privileged accounts. Microsoft Defender's automatic attack disruption cut those identities off and dropped their active sessions. One privileged account, though, had been left out of the automatic response, so it stayed usable.
About 90 minutes later, a larger wave hit 16 users and a second workstation, producing certificates for 8 more privileged accounts. Microsoft said more than 1,000 later attempts to reach files over SMB or to log in were blocked.
Within seconds of obtaining a certificate, the attacker signed in to a domain controller and ran DCSync, a tool for copying password data from Active Directory. The operation had already begun when containment took hold, limiting how much could be replicated. Microsoft did not say how much credential data the attacker obtained.
The excluded account was the opening. The attacker kept using it, reached a file server, and ran a renamed copy of the file-copying tool Rclone to move data from a share to an outside SFTP server. Microsoft did not say how much data was taken.
The case shows, in Microsoft's words, that "partial identity containment can reduce attack activity while still leaving a viable privileged route."
Case 2: A Certificate for the Domain Controller
The second intrusion began the same way but took a different direction because that template weakness was not present. The attacker instead used a technique called PetitPotam to force a domain controller to authenticate to a machine the attacker controlled.
That NTLM login was relayed to the AD CS web enrollment page, an abuse known as ESC8, with no password needed. The attacker used the relayed login to request a certificate for the domain controller itself. With that certificate and Kerberos (PKINIT), the attacker obtained a ticket-granting ticket for the domain controller, turning a one-off relayed login into a lasting identity.
Here the response held. Defender raised ESC8 alerts, the customer isolated the workstation, and Microsoft said no further activity followed.
The difference between the two came down to containment. In the first, automatic disruption blocked most of the attack, but the one excluded account stayed open. In the second, isolating a single workstation stopped it.
What Defenders Can Do
There is no patch, because nothing here was a software flaw. Microsoft's advice is about configuration and response.
- Have staff confirm any unexpected support request through a known internal channel before sharing a screen or handing over remote control. Limit which outside Teams tenants can reach employees, and allow only approved remote-support tools.
- Review sign-in certificate templates for ones that let the requester name the account, or that too many users can enroll in, and remove enrollment rights that are not needed.
- Require HTTPS and turn on Extended Protection for Authentication (EPA) on web enrollment endpoints, and turn off NTLM there where you can. Microsoft's KB5005413 covers this, and its Defender for Identity posture checks flag templates and endpoints exposed to ESC1 and ESC8.
- Turn on certificate auditing. If a bad certificate was issued, revoke it, but remember that revocation does not cancel Kerberos tickets already issued; review active tickets separately.
- Treat any account left out of automatic containment as a deliberate decision and assign a manual action in its place.
What Is and Isn't Known
Microsoft did not attribute the intrusions to any named group and did not give the dates on which they happened.
The methods are not new. Researchers named the ESC1 and ESC8 certificate weaknesses in 2021, and the PetitPotam coercion trick was disclosed the same year. Microsoft itself had documented the Teams help-desk-to-remote-access entry method earlier in 2026.
What this report adds is that the two techniques meet in real intrusions, along with the lesson about the excluded account.
Newer Windows is less exposed to the ESC8 step. Microsoft turned EPA on by default for AD CS in Windows Server 2025, whereas Server 2022 and 2019 require it to be enabled manually.
Indicators and Detections
Microsoft's report lists Defender alerts across Teams, endpoints, and identity signals, and four advanced hunting queries that it calls "starting points for investigation" rather than proof on their own. It also published three file hashes tied to the initial-access scripts:
- SHA-256
85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17(JavaScript initial-access script) - SHA-256
f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001(Python initial-access script) - SHA-256
06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7(Python initial-access script)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.