MalwareUsed by 1 actor

Certipy

Certipy is an open-source tool used for Active Directory discovery and abuse, particularly around Active Directory Certificate Services (AD CS) and collection of Active Directory-related credential and certificate data. In the provided reporting, Cisco Talos observed the China-linked threat actor UAT-8837 deploying Certipy during post-compromise activity against critical infrastructure organizations in North America since at least 2025. The actor used it alongside tools such as Rubeus, SharpHound, Impacket, GoExec, Earthworm, and DWAgent after gaining initial access via exploitation of vulnerable servers or use of compromised credentials, including in activity involving Sitecore vulnerability CVE-2025-53690. Talos specifically described Certipy as being used for AD discovery and abuse and for enumerating Active Directory users, groups, SPNs, service accounts, and domain relationships, as well as collecting Active Directory-related credential and certificate data. The reporting does not provide Certipy-specific indicators of compromise, but places its use within broader UAT-8837 intrusions involving credential harvesting, Kerberos abuse, remote execution, tunneling, and Active Directory reconnaissance.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

UAT-8837

Certipy, a tool for Active Directory discovery and abuse

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

18 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence4

Finally, I authenticated using the issued certificate... Authentication succeeded, allowing me to impersonate the Domain Administrator without ever knowing the Administrator’s password.

Persistence

4 techniques

T1078Valid AccountsEvidence4

Finally, I authenticated using the issued certificate... Authentication succeeded, allowing me to impersonate the Domain Administrator without ever knowing the Administrator’s password.

T1098Account ManipulationEvidence3

Add Shadow Credentials Same as before, we’ll create shadow credentials using Certipy: certipy-ad shadow auto ... Adding shadow creds to james account | Modify the UPN ... we’ll set it to a DC machine account — in this case, LAB-DC.LAB.LOCAL for Schannel certificate-based authentication. certipy-ad account update ... -upn 'lab-dc$@lab.local'

T1136.002Domain AccountEvidence1

Creating a New Computer Account ... we can create a new computer account using Certipy’s built-in add_computer command ... We’ll create a machine account named rbcd-test$.

T1556Modify Authentication ProcessEvidence3

If the certificate template lacks the required security extension (objectSid), and we control a user account, we can manipulate its attributes to request a certificate that gets mapped to a different identity, like a DA.

Privilege Escalation

4 techniques

T1078Valid AccountsEvidence4

Finally, I authenticated using the issued certificate... Authentication succeeded, allowing me to impersonate the Domain Administrator without ever knowing the Administrator’s password.

T1098Account ManipulationEvidence3

T1134Access Token ManipulationEvidence1

Since the UPN now matches that of the administrator, the certificate will be mapped to the administrator account during authentication, allowing us to impersonate them.

T1548Abuse Elevation Control MechanismEvidence3

If certificate templates are misconfigured, attackers can request certificates for other users, including Domain Administrators, leading to privilege escalation. In this lab, I exploited an ESC1 certificate template misconfiguration.

Stealth

2 techniques

T1078Valid AccountsEvidence4

Finally, I authenticated using the issued certificate... Authentication succeeded, allowing me to impersonate the Domain Administrator without ever knowing the Administrator’s password.

T1134Access Token ManipulationEvidence1

Since the UPN now matches that of the administrator, the certificate will be mapped to the administrator account during authentication, allowing us to impersonate them.

Defense Impairment

1 technique

T1556Modify Authentication ProcessEvidence3

Credential Access

6 techniques

T1003OS Credential DumpingEvidence3

This method relies on the ability to obtain the user’s NTLM hash using the PKINIT mechanism... Got NT hash for 'administrator@contoso.com'

T1556Modify Authentication ProcessEvidence3

T1558Steal or Forge Kerberos TicketsEvidence2

So, this is the most common use case for a certificate with Client Authentication EKU. If you can authenticate with the certificate, then you are able to get a TGT ticket.

T1606.001Web CookiesEvidence1

Through these techniques, threat actors abuse certificate templates which don’t require manager approval and include enrollment rights for low privileged users / groups.

T1606.002SAML TokensEvidence1

Shadow Credentials let us generate our own key pair and inject it into the msDS-KeyCredentialLink attribute of the target account. This gives us a way to authenticate as the user james without changing their actual password.

T1649Steal or Forge Authentication CertificatesEvidence15

Since the template was vulnerable, I requested a certificate while impersonating the Administrator account... Certipy successfully issued an Administrator certificate and saved it as: administrator.pfx

Discovery

3 techniques

T1018Remote System DiscoveryEvidence3

Step 1 — Enumerate AD CS First, I looked for vulnerable certificate templates using Certipy.

T1046Network Service DiscoveryEvidence1

The first step for threat actors after initial access is usually enumeration. Threat actors need to enumerate the certificate templates available for their compromised user as well as other AD attributes, in order to determine whether any of the ESC techniques is viable.

T1482Domain Trust DiscoveryEvidence2

We start by finding certificate templates that are vulnerable to ESC9. For that, we can use Certipy and provide domain user credentials along with the domain controller IP.

Lateral Movement

3 techniques

T1550Use Alternate Authentication MaterialEvidence2

Use the auth command to authenticate as administrator and grab the NT hash: certipy auth -pfx administrator.pfx -domain lab.local -dc-ip 10.129.228.236 ... Retrieved the Administrator NT hash

T1550.002Pass the HashEvidence1

Now using this hash, authenticate to Machine with evil-winrm... evil-winrm -i 10.10.11.41 -u management_svc -H a091c1832bcdd4677c28b5a6a1295584

T1550.003Pass the TicketEvidence1

Set RBCD on the DC ... the command modifies the msDS-AllowedToActOnBehalfOfOtherIdentity attribute on the DC’s computer object to include our new machine account.

Collection

1 technique

T1560Archive Collected DataEvidence1

It leverages endpoint process and filesystem data to spot the creation of files with specific names or extensions associated with Certipy's information gathering and exfiltration activities.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

bleeping computerNews

Jan 16, 2026

China-linked hackers exploited Sitecore zero-day for initial access

An AD CS enumeration/abuse tool used to collect certificate-related data and facilitate credential access via certificate services misconfigurations.

the hacker newsNews

Jan 16, 2026

China-Linked APT Exploited Sitecore Zero-Day in Critical Infrastructure Intrusion

A tool used for Active Directory discovery and abuse, particularly in certificate services contexts.

talos intelligence blogNews

Jan 15, 2026

UAT-8837 targets critical infrastructure sectors in North America

Tool for enumerating and abusing AD CS misconfigurations to escalate privileges and obtain persistence via certificate-based attacks.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping18

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Certipy