PKI authentication and NTLM deprecation define the identity risk gap

At a glance

What this is: This is an analysis of a multinational cyber advisory showing how Russian GRU unit 26165 is abusing weak authentication, legacy protocols and mailbox permissions to break identity trust.

Why it matters: It matters because authentication weakness is not just a user login problem; it is a control-plane issue for NHI, human and hybrid identity programmes that still rely on legacy trust assumptions.

Context

Identity trust is the assumption that an account, token, certificate or mailbox permission really belongs to the actor using it. In this article, that assumption is being actively attacked through password sprays, phishing, malware and abuse of older protocols such as NTLM.

The security gap is not theoretical. The advisory cited by Axiad describes a campaign against logistics and tech organisations supporting Ukraine, showing how legacy authentication and weak permission hygiene can become the easiest path into an enterprise.

Key questions

Q: What breaks when organisations keep NTLM enabled as a fallback for too long?

A: Long-term fallback use preserves legacy compatibility, but it also preserves weak authentication paths that attackers actively target. When NTLM remains available, phishing, relay, pass-the-hash, and brute-force techniques stay viable. The control gap is not just protocol age, but the operational habit of allowing insecure fallback to become normal.

Q: Why do weak mailbox permissions increase identity compromise risk?

A: Mailbox permissions can become a lateral path into recovery, delegation and trusted internal communication. When those permissions are too broad or poorly reviewed, an attacker who gets into email can often move from message access to wider identity abuse without needing an admin compromise.

Q: How should security teams prioritise PKI for identity protection?

A: Prioritise PKI where the consequences of credential abuse are highest, such as remote access, privileged sessions and on-premises hybrid workflows. That is where cryptographic proof offers the biggest reduction in replay, spraying and MFA fatigue exposure compared with password-based trust.

Q: What should teams do when a legacy authentication protocol cannot be removed quickly?

A: Treat it as an exception with compensating controls, explicit ownership and a documented retirement plan. Limit where it is allowed, monitor its use closely and avoid extending it into new workflows that would deepen the identity risk gap.

Technical breakdown

Why NTLM and password-based trust fail under sustained attack

NTLM is a legacy authentication protocol that was designed for a different trust model, one where password-derived credentials and network location carried more implicit confidence. Against modern adversaries, that model breaks because password spraying, token replay and phishing can all exploit the same underlying weakness: reusable human-readable trust. Once identity is asserted through something guessable or relayable, the attacker does not need to defeat the network, only the credential boundary. That is why the article positions certificate-backed authentication as a stronger control class, not merely a nicer login experience.

Practical implication: retire NTLM wherever possible and treat legacy authentication as an identity exposure, not just a compatibility issue.

How mailbox permissions and VPNs become identity entry points

Mailbox permissions matter because they can provide direct access to data, reset paths, or trusted internal communication without first compromising a privileged admin account. VPNs matter because they extend trust from the edge into the internal environment, often before stronger device or user assurance checks are applied. In a campaign that mixes phishing and malware, these controls are not separate problems. They are connected entry surfaces that let an attacker pivot from initial deception into persistent identity abuse, especially where authentication methods are old enough to be replayed or weak enough to be guessed.

Practical implication: review mailbox delegation and remote access trust paths as identity controls, not just messaging or network settings.

Why PKI changes the trust boundary for hybrid identity

PKI-based authentication shifts trust from secrets that can be guessed or phished to cryptographic proof bound to issued certificates. That changes the attack economics because the adversary now has to steal, misuse or forge a private key path rather than just coerce a password entry. In hybrid environments, this matters because certificate-backed identity can support on-premises systems such as AD, Exchange and RDP while also improving resistance to MFA fatigue and replay attacks. The real architectural value is not that certificates are perfect, but that they narrow the set of viable identity abuse paths.

Practical implication: use certificate-backed identity for high-risk workflows where password reset, token replay or MFA fatigue would be too easy to exploit.

Threat narrative

Attacker objective: The objective is to break identity trust just enough to gain persistent espionage access to targeted organisations and the information they hold.

1. Entry begins with password spraying, phishing lures and abused legacy authentication, giving the actor a foothold without needing a direct network exploit.
2. Credential access is reinforced through weak mailbox permissions, vulnerable VPN paths and NTLM-based trust that can be reused or replayed.
3. Escalation follows when those identity paths allow broader access to messaging, internal systems and trusted workflows that were not designed to resist modern credential abuse.
4. Impact is the theft of access needed to support persistent espionage against logistics and tech targets aligned with Ukraine.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
• Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity trust, not network trust, is the primary battleground in this campaign. The advisory shows that adversaries no longer need to defeat perimeter controls when weak authentication, legacy protocols and mailbox permissions already provide a trusted path inward. That is a structural identity failure, not a perimeter failure. Practitioners should treat authentication design as a frontline security domain, not an administrative afterthought.

NTLM persistence is a governance problem, not just a technical debt problem. NTLM remains in many environments because it is tolerated for compatibility, yet that tolerance creates an identity risk gap that attackers actively exploit. The issue is not merely that NTLM is old. The issue is that it encodes a trust assumption that modern phishing and password spraying can defeat at scale. Practitioners should view deprecation as a governance decision tied to risk ownership.

PKI authentication narrows identity attack surface because it replaces guessable trust with cryptographic proof. Smart cards and certificate-based authentication are harder to abuse through spraying, replay or MFA fatigue because the attacker cannot simply elicit a reusable secret. That does not make PKI magic, but it does materially change the identity control model. The practitioner conclusion is that high-risk access should move toward cryptographic proof, not password resilience.

Mailbox permissions are part of the identity control plane. The article correctly ties misconfigured mailbox access to the broader identity threat picture because messaging systems often sit close to recovery, delegation and privileged communication paths. When those permissions are loose, attackers can move laterally through trust rather than through technical exploitation. Security teams should reclassify mailbox access reviews as identity governance, not only collaboration tooling hygiene.

PKI lifecycle management is the difference between secure design and secure intention. Certificate-backed identity only remains defensible when issuance, renewal, revocation and policy enforcement are governed continuously across hybrid systems. Without that lifecycle discipline, organisations simply replace one unmanaged trust artifact with another. The practitioner takeaway is to treat certificate governance as a living control, not a one-time migration.

What this signals

Identity trust debt: legacy authentication, weak mailbox permissions and password-centric access models accumulate risk even when no breach is visible. The longer those controls remain in service, the more attacker techniques they continue to absorb.

For identity programmes, the practical shift is toward cryptographic proof, tighter permission boundaries and explicit deprecation ownership for any protocol that still depends on reusable trust.

For practitioners

• Deprecate NTLM on a controlled timeline Inventory systems that still depend on NTLM, rank them by exposure and business criticality, and remove the protocol from the highest-risk access paths first.
• Harden mailbox delegation and recovery paths Review mailbox permissions, shared inbox access and any account recovery routes that could let an attacker turn messaging access into broader identity compromise.
• Adopt certificate-backed authentication for sensitive access Use PKI-backed credentials for remote access, privileged sessions and other workflows where password spraying or MFA fatigue would create unacceptable exposure.
• Map legacy protocols to identity risk ownership Assign a named owner for each remaining legacy authentication dependency so deprecation, exception handling and compensating controls are tracked as security work.

Key takeaways

• The article frames identity security as the real front line because attackers are exploiting authentication trust rather than breaking through network controls.
• Legacy protocols such as NTLM and weak mailbox permissions create an identity risk gap that password spraying, phishing and malware can exploit repeatedly.
• Moving sensitive access toward PKI-backed authentication changes the attack economics by replacing guessable trust with cryptographic proof.

Key terms

• Certificate-based authentication: A method of proving identity using a cryptographic certificate and the associated private key rather than a reusable password. In identity programmes, it raises the bar for theft and replay because the secret is bound to lifecycle, issuance, and revocation control.
• Legacy authentication: Older login or protocol methods that remain in place for compatibility even after stronger controls exist. They often preserve weaker trust assumptions, which makes them attractive to attackers and difficult to defend if they are not tightly scoped and eventually retired.
• Mailbox Rule Abuse: Mailbox rule abuse occurs when an attacker creates or changes email rules to redirect, hide, or preserve messages. It is an identity risk because the attacker is using legitimate platform behaviour to maintain visibility and persistence after access, often without triggering obvious authentication alerts.
• Activation Trust Gap: The activation trust gap is the difference between trusting data because it is protected and governing it because it is being reused. It appears when organisations move data from backup or archival systems into AI pipelines without reapplying access, sensitivity, and consumer controls.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.