From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths

Two human-operated intrusions used Microsoft Teams to impersonate IT staff and socially engineer users into granting remote access via Quick Assist. Attackers deployed portable runtimes to perform network discovery and assessed Active Directory Certificate Services (AD CS) for authentication exploitation. One intrusion exploited an ESC1-vulnerable certificate template to obtain privileged authentication certificates and performed DCSync operations. The other used PetitPotam to coerce domain-controller authentication and relayed it via ESC8 to AD CS Web Enrollment, obtaining a domain-controller certificate for Kerberos authentication. Automated defenses limited the first intrusion except for an excluded privileged identity that enabled data exfiltration, while customer-led isolation stopped the second intrusion after Defender alerts.

• Hackers Impersonate IT Help Desk on Microsoft Teams to Hijack Active Directory Accounts and Steal DataMalware2026-10-31
• Hackers Use Fake ChatGPT Plus Billing Emails to Steal Credit Card Details and OTP CodesCampaign2026-11-02
• North Korea's Crypto Heists Start on the Open InternetMalware2026-10-31
• Managed for Malice: How Attackers Turn MDM into Remote AccessCampaign2026-10-28
• Locked and Loaded: Phishing through Fake Bids and Protected DocumentsCampaign2026-10-27