Loading story…
A comprehensive framework for understanding and defending against Active Directory (AD) attacks outlines the sequential stages of compromise, from reconnaissance and initial access to privilege escalation and domain dominance. The model emphasizes targeted countermeasures at each phase, such as limiting information exposure, enforcing strong password policies, implementing multi-factor authentication, and conducting regular privilege audits. As AD remains a critical target for advanced persistent threats (APTs) and ransomware groups, mastering these defensive strategies is essential for protecting hybrid environments and mitigating risks associated with attacks like Kerberos trust exploitation and Golden Ticket attacks.
In parallel, analysis of the five costliest US breaches of 2025 highlights the importance of prioritizing control planes and identity providers as tier-0 assets, rapid revocation of compromised credentials, and enforcing just-in-time privileged access management. The incidents, which affected organizations such as Ingram Micro, Conduent, Kettering Health, F5, and Sensata, were characterized by tactics including valid account abuse, account manipulation, data exfiltration, and ransomware deployment. Key lessons include the need for enterprise-wide revocation capabilities, isolation of critical networks, and robust manual continuity procedures to minimize operational and financial impact during major security incidents.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A retrospective analysis identified Ingram Micro, Conduent, Kettering Health, F5, and Sensata Technologies as the five costliest U.S. cyber incidents of 2025, summarizing their financial impact, common identity-focused intrusion patterns, and containment lessons. The article references prior public disclosures and filings but does not provide enough dated incident detail to extract separate discrete events for each breach from this content alone.
A 2026 reference on the Active Directory attack kill chain was published, consolidating known attack stages, common tools, notable AD-related vulnerabilities, and defensive best practices for on-premises and hybrid Azure AD environments. The piece is a general framework rather than a report of a single new incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceblog.alphahunt.io
Open sourcelabs.infoguard.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Incident response findings and large-scale Active Directory assessments show that attackers can often escalate from a low-privileged account to **full domain compromise** by chaining common identity weaknesses. Microsoft reported repeated cases of "total identity compromise" tied to excessive privilege, weak password policies, poor credential hygiene, insecure delegation, ACL abuse, Group Policy abuse, trust relationship weaknesses, and exposure of other Tier 0 assets. Separate analysis of 250 PingCastle reports found the same patterns at scale, including delegable administrator accounts, Kerberoast exposure, weak Kerberos encryption, dangerous Group Policy assignments, and exploitable Print Spooler configurations on domain controllers. The assessments also highlighted persistent weaknesses in **Active Directory Certificate Services (AD CS)** and service account management. Research on **Certified Pre-Owned** and AD CS hardening showed that certificate template and enrollment misconfigurations can let attackers impersonate privileged users and gain durable access, while DFIR reporting found widespread service accounts with non-expiring passwords, excessive privileges, and Kerberoastable administrator accounts. Microsoft guidance points defenders toward continuous AD auditing with tools such as Defender for Identity, BloodHound, and PingCastle, along with privilege reduction, stronger authentication, hardened delegation and trust settings, and tighter governance of managed and legacy service accounts to close common escalation paths.
Aug 1, 2026
Attackers are increasingly leveraging advanced credential theft techniques to compromise Microsoft-based environments, with a focus on identity-first intrusions and abuse of authentication protocols. Kerberoasting attacks have resurged, exploiting legacy RC4 encryption in Kerberos to crack service account passwords, as seen in the Ascension Health ransomware incident. These attacks are facilitated by weak password policies and the continued use of outdated encryption, allowing threat actors to obtain domain administrator credentials and move laterally within networks. The prevalence of credential-based intrusions is underscored by threat intelligence reports indicating that identity attacks are now the leading entry point for breaches. Simultaneously, authentication coercion attacks are evolving, enabling adversaries to force Windows systems to authenticate to attacker-controlled infrastructure without user interaction. Techniques such as exploiting rarely monitored RPC interfaces and tools like PetitPotam (CVE-2021-36942) have been observed in real-world incidents, targeting critical assets like Domain Controllers. Additionally, threat actors are abusing OAuth consent, device code flow, and service principal credential manipulation to maintain persistent, stealthy access to cloud and SaaS platforms, often pivoting from on-premises exploits to Microsoft 365 environments. Organizations are advised to implement robust monitoring, enforce strong authentication policies, and phase out legacy protocols to mitigate these threats.
Jun 29, 2026
Sophos reported that intruders are moving from initial access to high-value targets with increasing speed, with median time to reach **Active Directory** measured in hours rather than days. The company's 2026 Active Adversary Report says attackers frequently exploit exposed remote services, valid accounts, and unpatched edge devices to gain entry, then use built-in administrative tools and hands-on-keyboard activity to expand access while blending into normal operations. The report says ransomware and data-theft operations continue to dominate incident response cases, with adversaries prioritizing credential access, lateral movement, and rapid privilege escalation once inside a network. Sophos said the findings reflect a persistent trend toward shorter breakout times, heavier abuse of legitimate tools, and more disciplined post-compromise tradecraft, increasing pressure on defenders to harden internet-facing systems, monitor identity infrastructure, and accelerate detection and response across the enterprise.
Jul 12, 2026