LUCAMEResearchers at Microsoft have documented an attack chain that starts with someone pretending to be IT support over Teams. From there, the attacker gains remote access, runs malicious code, and then exploits weaknesses in Active Directory Certificate Services to move deeper into the network. The techniques used, known as ESC1 and ESC8, let an attacker forge authentication credentials and essentially become a domain administrator. It's a multi-stage attack, but each step is fairly well understood by now.
What this means for your business
If your business uses Microsoft Teams for internal support requests and runs Active Directory on Windows Server, this is directly relevant to you. The attack starts with social engineering, so staff need to know they should verify anyone asking for remote access, even if they claim to be from IT. On the technical side, whoever manages your infrastructure should check that Active Directory Certificate Services is properly locked down, particularly the certificate templates and web enrolment endpoints that these attacks rely on.