Microsoft Threat Intelligence disclosed on October 30 that attackers are impersonating IT help desk staff on Microsoft Teams, talking employees into approving a remote-support session, and then abusing misconfigured Active Directory Certificate Services (AD CS) to walk out with domain admin privileges — and in one case, stolen data. There is no Teams vulnerability being exploited; the attack works on fully patched, properly licensed Microsoft 365 tenants that haven't locked down external chat and AD CS. For small businesses in York County that run on Microsoft 365 and a Windows domain, this is the exact kind of attack chain your IT provider should already be hardening against.
What Microsoft actually found
In a research post published October 30, Microsoft documented two incidents that followed the same initial sequence: help desk impersonation through Teams, a user-approved Quick Assist or other remote-support session, archive transfer and extraction, portable runtime execution, and host and AD CS discovery. From there, the attackers split into two different escalation paths that both end in full Active Directory compromise.
Microsoft's investigation emphasized that neither incident exploited a Teams vulnerability. Instead, attackers combined impersonation, legitimate remote access software, portable runtimes, and insecure certificate configurations. In plain English: a human on your team got tricked into clicking "Approve" on a remote-control request, and the attacker did the rest using tools that were already there.
In the second case Microsoft investigated, attackers used PetitPotam over EFSRPC to coerce domain-controller authentication. They relayed its NTLM authentication to inadequately protected AD CS Web Enrollment, obtaining a certificate for the domain-controller account through ESC8. The certificate supported Kerberos PKINIT authentication and issuance of a domain-controller ticket-granting ticket. At that point the attacker is, effectively, the domain controller.
Why this matters to a 15-person York County business
If your company uses Microsoft 365 with Teams, and your office runs on a Windows domain (any business with a file server, shared logins, or an on-prem server almost certainly does), you are in scope. The lure is simple and effective: attackers use impersonation-focused display names such as IT Helpdesk and Helpdesk Support, along with attacker-controlled tenant and domain patterns. Often they'll flood the user's inbox with spam first, then message on Teams offering to "help clean it up."
This isn't a one-off. This is the third time this year Microsoft has documented help desk impersonation leading somewhere serious, after reports in April and September. The pattern is now the dominant initial-access technique for mid-sized ransomware intrusions.
What your managed IT provider should be doing this week
A competent MSP should already be executing on the following — and if yours isn't, push for answers. First, lock down Teams external access so random outside tenants can't chat or call your employees; most small businesses have no business reason to accept inbound Teams messages from the public internet. Second, audit your AD CS configuration for the ESC1 and ESC8 weaknesses Microsoft called out — vulnerable certificate templates and unprotected Web Enrollment endpoints are the actual turnkeys here. Third, disable or tightly control Quick Assist and any other built-in remote-support tool employees can approve without a ticket. Fourth, publish a one-sentence rule to every employee: real IT will never cold-message you on Teams and ask for remote control.
Microsoft's own guidance aligns: verify unsolicited support requests through a known internal channel, and tighten Teams external access and federation policies. If you don't have a provider actively doing identity hardening, AD CS review, and user-awareness training, that's the gap this attack is designed to walk through — and it's exactly the kind of work covered under York Computer's managed IT and cybersecurity services. For companies with an in-house IT person already running the domain, a co-managed arrangement gives that person backup on the AD CS audit, Teams policy lockdown, and 24/7 monitoring for the exact behaviors Microsoft flagged.
Red flags to train your team on today
Train every employee to treat the following as automatic shut-it-down events: an unexpected Teams message from someone claiming to be IT, especially from an outside organization; any request to open Quick Assist, read back a security code, or approve a "request for control" during screen sharing; a sudden flood of spam email followed by a Teams message offering help. The decisive moment in this attack isn't technical — the user may be asked to approve a request for control during Teams screen sharing or open Quick Assist and read back a connection code. Approval gives the external operator control of a workstation inside the user's authenticated environment. One click is the whole breach.
What York Businesses Should Do
For York County small businesses, the practical move this week is a five-minute conversation with your IT provider: ask specifically whether Teams external chat is restricted, whether AD CS has been audited for ESC1/ESC8, and whether Quick Assist is disabled or policy-controlled. If any answer is "I'll have to check," treat that as the finding.
Sources
- From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths (Microsoft Security Blog)
- Hackers Impersonate IT Help Desk on Microsoft Teams to Gain Domain Admin Access via AD CS Attacks (GBHackers)
- Microsoft Ties Help Desk Impersonation to AD CS Cert Theft (Techaeris)
- Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access (Arctic Wolf)