Loading story…
Incident response findings and large-scale Active Directory assessments show that attackers can often escalate from a low-privileged account to full domain compromise by chaining common identity weaknesses. Microsoft reported repeated cases of "total identity compromise" tied to excessive privilege, weak password policies, poor credential hygiene, insecure delegation, ACL abuse, Group Policy abuse, trust relationship weaknesses, and exposure of other Tier 0 assets. Separate analysis of 250 PingCastle reports found the same patterns at scale, including delegable administrator accounts, Kerberoast exposure, weak Kerberos encryption, dangerous Group Policy assignments, and exploitable Print Spooler configurations on domain controllers.
The assessments also highlighted persistent weaknesses in Active Directory Certificate Services (AD CS) and service account management. Research on Certified Pre-Owned and AD CS hardening showed that certificate template and enrollment misconfigurations can let attackers impersonate privileged users and gain durable access, while DFIR reporting found widespread service accounts with non-expiring passwords, excessive privileges, and Kerberoastable administrator accounts. Microsoft guidance points defenders toward continuous AD auditing with tools such as Defender for Identity, BloodHound, and PingCastle, along with privilege reduction, stronger authentication, hardened delegation and trust settings, and tighter governance of managed and legacy service accounts to close common escalation paths.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Microsoft published updated documentation describing how gMSAs and sMSAs work, including password management, deployment requirements, and the need to configure stronger Kerberos encryption such as AES for managed service accounts.
dfir.ch published the second part of its 250-report PingCastle analysis, documenting recurring weaknesses such as dangerous GPO-assigned privileges, delegable administrator accounts, weak Kerberos settings, Kerberoast exposure, and Print Spooler abuse paths on domain controllers.
dfir.ch published the first part of its analysis of 250 PingCastle reports, highlighting widespread AD CS misconfigurations, weak service-account governance, insecure password practices, incomplete PowerShell logging, and MachineAccountQuota abuse risk.
Microsoft Incident Response published guidance stating that most incident-response engagements involving on-premises Active Directory include total domain compromise, and outlined common escalation paths and defensive recommendations.
SpecterOps published the 'Certified Pre-Owned' whitepaper detailing attack techniques for abusing Active Directory Certificate Services and highlighting AD CS as a path to domain compromise.
Microsoft introduced group Managed Service Accounts (gMSAs) in Windows Server 2012, extending managed service account functionality across multiple servers in a domain with Windows-managed passwords.
Microsoft introduced standalone Managed Service Accounts (sMSAs) in Windows Server 2008 R2 and Windows 7, providing automatic password management and simplified SPN handling for services.
In one incident response investigation cited by dfir.ch, attackers attempted to exploit PrintNightmare (CVE-2021-34527), illustrating how Print Spooler exposure on domain controllers can support privilege escalation or remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
learn.microsoft.com
Open sourcedfir.ch
Open sourcedfir.ch
Open sourcetechcommunity.microsoft.com
Open sourcetechcommunity.microsoft.com
Open sourceposts.specterops.io
Open sourceservices.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and defenders warned that **Active Directory Certificate Services (AD CS)** can be abused to take over Windows domains through a combination of certificate misconfigurations and NTLM relay paths. SpecterOps documented multiple escalation techniques in its **Certified Pre-Owned** research, including vulnerable certificate templates, arbitrary Subject Alternative Name abuse, weak access controls, and relay attacks against AD CS web enrollment endpoints. The findings showed that attackers can obtain certificates usable for **PKINIT** or **Schannel** authentication, enabling privilege escalation, persistence that survives password resets, and in some cases creation of forged **"golden certificates"** if a CA private key is stolen. The risk became more urgent as the **PetitPotam** attack chain demonstrated how coercing NTLM authentication from a domain controller and relaying it to AD CS could lead to complete domain compromise. SANS highlighted the issue as a path to **domain admin**, while Microsoft published advisory **`ADV210003`** with mitigations rather than a security patch, recommending steps such as enabling **Extended Protection for Authentication**, requiring **HTTPS** on certificate enrollment endpoints, and reducing or disabling **NTLM** where possible. The combined disclosures showed that widely deployed AD CS environments could become a direct route to full Active Directory takeover if left misconfigured.
Jun 29, 2026
A comprehensive framework for understanding and defending against Active Directory (AD) attacks outlines the sequential stages of compromise, from reconnaissance and initial access to privilege escalation and domain dominance. The model emphasizes targeted countermeasures at each phase, such as limiting information exposure, enforcing strong password policies, implementing multi-factor authentication, and conducting regular privilege audits. As AD remains a critical target for advanced persistent threats (APTs) and ransomware groups, mastering these defensive strategies is essential for protecting hybrid environments and mitigating risks associated with attacks like Kerberos trust exploitation and Golden Ticket attacks. In parallel, analysis of the five costliest US breaches of 2025 highlights the importance of prioritizing control planes and identity providers as tier-0 assets, rapid revocation of compromised credentials, and enforcing just-in-time privileged access management. The incidents, which affected organizations such as Ingram Micro, Conduent, Kettering Health, F5, and Sensata, were characterized by tactics including valid account abuse, account manipulation, data exfiltration, and ransomware deployment. Key lessons include the need for enterprise-wide revocation capabilities, isolation of critical networks, and robust manual continuity procedures to minimize operational and financial impact during major security incidents.
Jun 29, 2026
Semperis disclosed two Active Directory privilege-escalation vulnerabilities involving hidden and unfilterable Unicode characters that can undermine Microsoft’s identity protections. The first flaw, **KerberLoss** (`CVE-2026-25177`), lets a low-privileged user with service principal name (SPN) write permissions bypass SPN and SPN-alias uniqueness checks, enabling denial of service against `HOST`-mapped services, SPN-jacking in constrained delegation scenarios, and forced Kerberos-to-NTLM downgrade. The second flaw, **ResetNightmare** (`CVE-2026-27912`), is more severe and allows an attacker who can write a user principal name (UPN) on a user or computer object to abuse NT-ENTERPRISE name handling and the Kerberos password-change protocol to reset a privileged account’s password and gain Domain Admin access. The findings build on Microsoft’s earlier hardening work for `CVE-2021-42282`, which introduced uniqueness verification for UPNs, SPNs, and SPN aliases, but the new research shows those checks could still be bypassed under certain conditions. Microsoft patched **KerberLoss** in March 2026 and **ResetNightmare** in April 2026. Defenders were urged to update domain controllers, restrict delegated rights that allow SPN or UPN modification, and monitor Active Directory changes—particularly suspicious SPN and UPN edits such as **Event ID 5136**—for signs of exploitation.
Aug 6, 2026