What Happened
Two recent intrusion investigations began with attackers impersonating IT staff in Microsoft Teams. They persuaded users to grant Quick Assist access, then used staged payloads and portable runtimes to inspect the environment and target Active Directory Certificate Services (AD CS). In one case, a vulnerable certificate template enabled issuance of certificates for privileged accounts and the start of DCSync activity. In the other, the attacker relayed coerced domain-controller authentication to AD CS Web Enrollment and obtained a certificate usable for Kerberos authentication. The second attack stopped after an alert and workstation isolation; in the first, an account excluded from disruption remained usable and was later involved in file-server access and data exfiltration [1].
Separately, Microsoft assesses that North Korean threat actors are using AI to accelerate reconnaissance, impersonation, phishing-lure production and some malware-development work. Its examples include AI-assisted fraudulent job applications and more than 100 target-specific PDF lures. Microsoft describes AI as amplifying human-directed operations, not replacing their operators [2].
Why It Matters to Businesses
These findings describe a combined risk: convincing contact can create an initial foothold, while identity and certificate misconfigurations can turn that foothold into durable access. AI can increase the volume and specificity of deceptive messages, but the AD CS weaknesses in these cases were conventional infrastructure exposures. Blocking a payload or isolating one workstation may not end an incident if an issued certificate, Kerberos ticket or excluded identity remains usable [1][2].
Kimbodo Engineering Perspective
We would prioritize breaking the intrusion path over trying to determine whether a message was AI-generated. Controls on remote support, certificate enrollment and privileged identity have clearer enforcement points than judgments about writing style. Detection still matters: the first case shows why response exclusions must be reviewed during an incident, even when automated disruption blocks substantial follow-on activity [1].
The trade-off is operational. Removing external Teams access or Quick Assist entirely may impede legitimate support; disabling certificate enrollment without mapping dependencies may break authentication. Design narrowly scoped access, approved support workflows and tested AD CS changes rather than relying on blanket restrictions that teams will bypass.
How We Would Implement It
- Constrain entry points: Limit external Teams contact where appropriate, require verified help-desk workflows for remote assistance, and control execution of portable runtimes and scripts [1].
- Harden identity infrastructure: Audit AD CS templates for ESC1 exposure and Web Enrollment for ESC8 exposure; restrict enrollment and relay opportunities, then test legitimate certificate-dependent applications before changes go live [1].
- Join the evidence: Correlate Teams and endpoint events with EFSRPC, certificate authority, Web Enrollment and Kerberos logs. Alert on suspicious certificate issuance and investigate subsequent use of affected identities [1].
- Contain the whole access path: Review response exclusions and affected accounts; address unauthorized certificates and active Kerberos tickets separately. Validate that access has ended rather than treating workstation isolation as sufficient [1].
- Prepare for higher-volume deception: Strengthen phishing protection and employee screening, and keep endpoint and attack-disruption protections current [2].
Risks, Costs and Security
AD CS remediation requires inventory, change testing and coordination with identity owners. Cross-domain detection requires reliable logging and investigation capacity; otherwise, alerts may reveal activity without establishing whether a certificate or account is still usable. AI-enabled lures add pressure to screening and triage, but the more consequential failure is an unresolved trust path from impersonation to privileged authentication [1][2].
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Security & Guardrails practice, or Request a Security Review.
