As detailed in The Hacker News, attackers are leveraging social engineering and insecure Active Directory Certificate Services configurations to compromise corporate environments.
The attack begins with threat actors posing as IT support via Microsoft Teams. By impersonating help desk staff, they convince employees to use the built-in Quick Assist tool, granting the attackers remote control of the workstation. Once inside, they deploy malicious scripts to exploit Active Directory Certificate Services (AD CS). In one observed intrusion, attackers utilized an ESC1 template vulnerability to request certificates for privileged accounts, allowing them to impersonate administrators and exfiltrate data. A second intrusion involved the PetitPotam technique to force domain controller authentication, enabling the acquisition of a domain controller certificate via an ESC8 relay attack. Microsoft noted that these incidents highlight the risks of misconfigured certificate templates and the necessity of robust identity containment. Because these methods rely on configuration weaknesses rather than software flaws, there is no patch. Microsoft recommends that organizations verify support requests through internal channels, disable unnecessary enrollment rights, and enable Extended Protection for Authentication on web enrollment endpoints to mitigate these persistent threats.
Source: The Hacker News
