Actor Profile

This campaign involves unattributed threat actors conducting human-operated intrusions against technology and enterprise sectors. The operators demonstrate sophisticated understanding of Active Directory Certificate Services (AD CS) exploitation, social engineering tactics, and identity-based persistence mechanisms. Motivation appears to be credential harvesting, privilege escalation, and data exfiltration. The activity is not attributed to a specific named threat actor group, suggesting either a novel operation or deliberate OPSEC to obscure attribution. The actors leverage legitimate remote access tools and portable runtimes to evade detection while exploiting misconfigured certificate templates and authentication relay vulnerabilities.

TTPs (Tactics, Techniques, Procedures)

Initial Access: T1566.002 (Phishing: Spearphishing Link) via Microsoft Teams impersonation of IT/help desk personnel. Execution: T1059 (Command and Scripting Interpreter) using portable Python, Bun, and Java runtimes staged from user-writable locations. Discovery: T1018 (Remote System Discovery) and T1087 (Account Discovery) for host and AD CS enumeration. Credential Access: T1649 (Steal or Forge Authentication Certificates) through ESC1 certificate template abuse and ESC8 NTLM relay to AD CS Web Enrollment; T1557.001 (Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay) via PetitPotam-coerced authentication relay; T1003.006 (OS Credential Dumping: DCSync) to extract domain credentials. Persistence: T1556 (Modify Authentication Process) through certificate-based Kerberos authentication (PKINIT). Lateral Movement: T1021 (Remote Services) via compromised privileged certificates. Exfiltration: T1041 (Exfiltration Over C2 Channel) observed in Case 1 following privilege escalation.

Targets & Patterns

The campaign targets technology and enterprise sectors, specifically organizations with Active Directory Certificate Services deployments. Victims are selected based on the presence of misconfigured AD CS environments with ESC1-vulnerable certificate templates or ESC8-susceptible Web Enrollment endpoints lacking NTLM relay protections. The initial targeting relies on social engineering end users who have access to Quick Assist or similar remote support tools. The pattern suggests opportunistic targeting of organizations with weak AD CS security postures rather than sector-specific intelligence requirements. The threat actors demonstrate knowledge of which organizations maintain insecure certificate configurations, possibly through prior reconnaissance or access broker relationships. Both cases show the actors pivoting from initial user access to domain-level compromise, indicating enterprise domain infrastructure is the ultimate target.

Historical Context

This campaign represents an evolution in AD CS exploitation techniques documented in security research. ESC1 and ESC8 abuse paths were publicly detailed in the SpecterOps whitepaper "Certified Pre-Owned" (2021), which catalogued eight AD CS escalation scenarios. PetitPotam, the NTLM relay technique used in Case 2, was disclosed in July 2021 and has been incorporated into multiple APT and ransomware operator toolkits since then. The use of Microsoft Teams for social engineering reflects a broader trend observed since 2022, where threat actors abuse collaboration platforms for initial access, including campaigns by Storm-0324, Scattered Spider, and other financially motivated groups. The portable runtime staging technique (Python, Bun, Java) aligns with living-off-the-land tactics increasingly adopted to evade endpoint detection. The combination of Teams-based social engineering with AD CS exploitation represents a maturation of publicly available techniques into a repeatable intrusion pattern, though this specific campaign chain has not been previously documented as a unified operation.

Defensive Recommendations

  • Harden AD CS certificate templates by disabling ESC1-vulnerable configurations: remove 'Supply in request' subject name options, restrict enrollment permissions to specific security groups, and enable manager approval for sensitive templates
  • Disable AD CS Web Enrollment (ESC8 attack surface) or implement Extended Protection for Authentication (EPA) and require HTTPS with channel binding to prevent NTLM relay attacks
  • Enable Microsoft Teams external access controls: configure external access policies to display clear 'External' and 'Scam suspected' indicators, and educate users to verify support requests through out-of-band channels before granting remote access
  • Monitor for certificate enrollment anomalies using Event ID 4886 (certificate request) and 4887 (certificate issued) in Security logs, especially requests for privileged accounts or domain controller identities from unexpected sources
  • Detect portable runtime staging via Sysmon Event ID 1 (process creation) for python.exe, bun.exe, java.exe executing from user-writable paths (e.g., %TEMP%, %APPDATA%, Downloads) with suspicious parent processes like Quick Assist or remote desktop tools
  • Implement Microsoft Defender attack disruption with comprehensive identity coverage, ensuring no privileged accounts are excluded from automated containment policies to prevent persistence through certificate-backed authentication
  • Hunt for PetitPotam and NTLM relay indicators: monitor Event ID 4768 (Kerberos TGT request) for certificate-based authentication (PKINIT), and review network traffic to AD CS Web Enrollment endpoints for suspicious authentication patterns