Loading story…
CISA and five international cybersecurity agencies issued technical guidance detailing 17 attacker techniques targeting Microsoft Active Directory environments. The guidance covers abuse of Active Directory Domain Services (AD DS), Active Directory Certificate Services (AD CS), and Active Directory Federation Services (AD FS), including credential theft, Kerberos ticket forgery, directory-replication abuse, certificate abuse, privilege escalation, lateral movement, persistence, and hybrid-identity compromise.
The agencies warned that an Active Directory compromise can expose enterprise accounts, infrastructure, applications, email, and connected cloud services. They recommend designating domain controllers, certificate authorities, AD FS servers, and Microsoft Entra Connect as Tier 0 assets; hardening authentication, delegation, certificate, and service-account configurations; and centrally collecting and baselining authentication, directory, certificate, and synchronization logs to detect malicious activity that can resemble legitimate administration.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
CISA, the NSA, the Australian Cyber Security Centre, and partner agencies in Canada, the United Kingdom, and New Zealand released technical guidance describing 17 techniques used to compromise Microsoft Active Directory environments, including AD DS, AD CS, and AD FS.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Incident response findings and large-scale Active Directory assessments show that attackers can often escalate from a low-privileged account to **full domain compromise** by chaining common identity weaknesses. Microsoft reported repeated cases of "total identity compromise" tied to excessive privilege, weak password policies, poor credential hygiene, insecure delegation, ACL abuse, Group Policy abuse, trust relationship weaknesses, and exposure of other Tier 0 assets. Separate analysis of 250 PingCastle reports found the same patterns at scale, including delegable administrator accounts, Kerberoast exposure, weak Kerberos encryption, dangerous Group Policy assignments, and exploitable Print Spooler configurations on domain controllers. The assessments also highlighted persistent weaknesses in **Active Directory Certificate Services (AD CS)** and service account management. Research on **Certified Pre-Owned** and AD CS hardening showed that certificate template and enrollment misconfigurations can let attackers impersonate privileged users and gain durable access, while DFIR reporting found widespread service accounts with non-expiring passwords, excessive privileges, and Kerberoastable administrator accounts. Microsoft guidance points defenders toward continuous AD auditing with tools such as Defender for Identity, BloodHound, and PingCastle, along with privilege reduction, stronger authentication, hardened delegation and trust settings, and tighter governance of managed and legacy service accounts to close common escalation paths.
Aug 1, 2026
A comprehensive framework for understanding and defending against Active Directory (AD) attacks outlines the sequential stages of compromise, from reconnaissance and initial access to privilege escalation and domain dominance. The model emphasizes targeted countermeasures at each phase, such as limiting information exposure, enforcing strong password policies, implementing multi-factor authentication, and conducting regular privilege audits. As AD remains a critical target for advanced persistent threats (APTs) and ransomware groups, mastering these defensive strategies is essential for protecting hybrid environments and mitigating risks associated with attacks like Kerberos trust exploitation and Golden Ticket attacks. In parallel, analysis of the five costliest US breaches of 2025 highlights the importance of prioritizing control planes and identity providers as tier-0 assets, rapid revocation of compromised credentials, and enforcing just-in-time privileged access management. The incidents, which affected organizations such as Ingram Micro, Conduent, Kettering Health, F5, and Sensata, were characterized by tactics including valid account abuse, account manipulation, data exfiltration, and ransomware deployment. Key lessons include the need for enterprise-wide revocation capabilities, isolation of critical networks, and robust manual continuity procedures to minimize operational and financial impact during major security incidents.
Jun 29, 2026
CISA added **`CVE-2026-56155`** to its Known Exploited Vulnerabilities catalog after reports of active exploitation against **Microsoft Active Directory Federation Services (AD FS)**. The flaw is an elevation-of-privilege vulnerability caused by insufficient granularity of access control, mapped to **`CWE-1220`**, and allows an authorized attacker to elevate privileges locally on affected systems. Microsoft rated the issue **High** with a **CVSS v3.1 score of `7.8`** and said it affects multiple supported Windows and Windows Server versions running AD FS, with patched builds available. CISA said ransomware use is unknown, directed organizations to apply Microsoft’s mitigations and follow associated forensic triage guidance, and set a **2026-07-28** remediation deadline for federal agencies under **BOD 26-04**.
Jul 15, 2026