Cyberattackers Target Windows Domain Controllers in Credential Theft Campaign
Threat actors exploiting Windows networks are increasingly focusing on domain controllers the servers managing identities and permissions to escalate breaches. A successful compromise of the Active Directory (AD) database can expose password hashes for every account in the domain, turning a localized intrusion into a full-scale compromise.
Researchers at Trellix detailed an attack chain that often begins with spearphishing, malicious Office macros, shortcut files, or tampered installers. A lightweight first-stage payload runs in memory, contacts an attacker-controlled server, and escalates privileges before moving laterally toward the domain controller while mimicking legitimate Windows activity.
Once attackers gain SYSTEM-level access, they target the NTDS.dit file the AD database typically locked during operation. By abusing the Volume Shadow Copy Service (VSS), they create a readable copy, bypassing security restrictions. The stolen database, paired with a registry hive containing the boot key, can reveal NTLM hashes, Kerberos keys, and password histories for all domain accounts.
In Trellix’s simulated attack, threat actors used SMB and remote administration tools to exfiltrate the files via HTTPS to cloud storage. Even without cracking passwords, attackers can leverage stolen hashes for pass-the-hash attacks, impersonating privileged users or maintaining persistence.
The most severe risk involves the KRBTGT account secret, which enables the creation of a Golden Ticket a forged Kerberos logon ticket granting unrestricted domain access. Unless the KRBTGT keys are rotated, attackers can regain entry even after partial remediation.
Detection and Mitigation
Defenders are advised to monitor domain controllers for:
- Unusual privileged access or shadow-copy creation
- Suspicious file transfers (SMB, HTTPS) from domain controllers
- Credential dumping, DCSync attacks, or forged Kerberos tickets
Organizations should restrict VSS access, disable NTLM where unnecessary, and enforce Protected Users group policies. Post-compromise, isolating affected systems, resetting exposed accounts, and rotating KRBTGT keys are critical steps.
Trellix’s findings underscore that identity infrastructure remains a prime target after initial breaches. Detecting behavioral anomalies rather than relying solely on known malware signatures is key to preventing long-term control by attackers.
Source: https://cybersecuritynews.com/hackers-steal-ntds-dit/
Microsoft TPRM report: https://www.rankiteo.com/company/microsoft-security
"id": "mic1790065443",
"linkid": "microsoft-security",
"type": "Cyber Attack",
"date": "9/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'type': 'Organizations using Windows domain '
'controllers'}],
'attack_vector': ['spearphishing',
'malicious Office macros',
'shortcut files',
'tampered installers'],
'data_breach': {'data_exfiltration': 'Yes (via SMB and HTTPS to cloud '
'storage)',
'file_types_exposed': ['NTDS.dit', 'Registry hive'],
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['NTLM hashes',
'Kerberos keys',
'Password histories',
'KRBTGT account secrets']},
'description': 'Threat actors exploiting Windows networks are increasingly '
'focusing on domain controllers to escalate breaches. A '
'successful compromise of the Active Directory (AD) database '
'can expose password hashes for every account in the domain, '
'turning a localized intrusion into a full-scale compromise. '
'Attackers use spearphishing, malicious Office macros, '
'shortcut files, or tampered installers to gain initial '
'access, then escalate privileges and move laterally toward '
'the domain controller. They abuse the Volume Shadow Copy '
'Service (VSS) to steal the NTDS.dit file, which contains NTLM '
'hashes, Kerberos keys, and password histories for all domain '
'accounts. Stolen hashes enable pass-the-hash attacks, and the '
'KRBTGT account secret allows the creation of a Golden Ticket '
'for unrestricted domain access.',
'impact': {'data_compromised': 'NTLM hashes, Kerberos keys, password '
'histories, KRBTGT account secrets',
'identity_theft_risk': 'High',
'operational_impact': 'Full-scale domain compromise, unauthorized '
'privileged access',
'systems_affected': ['Windows domain controllers',
'Active Directory']},
'lessons_learned': 'Identity infrastructure remains a prime target after '
'initial breaches. Detecting behavioral anomalies rather '
'than relying solely on known malware signatures is key to '
'preventing long-term control by attackers.',
'motivation': 'Credential theft, privilege escalation, and persistent domain '
'access',
'post_incident_analysis': {'corrective_actions': ['Restrict VSS access',
'Disable NTLM',
'Enforce Protected Users '
'group policies',
'Rotate KRBTGT keys',
'Enhance monitoring for '
'behavioral anomalies'],
'root_causes': 'Abuse of Volume Shadow Copy '
'Service (VSS) to extract NTDS.dit '
'file, lack of monitoring for '
'unusual privileged access or '
'shadow-copy creation'},
'recommendations': ['Restrict VSS access',
'Disable NTLM where unnecessary',
'Enforce Protected Users group policies',
'Monitor domain controllers for unusual activity',
'Rotate KRBTGT keys post-compromise'],
'references': [{'source': 'Trellix'}],
'response': {'containment_measures': ['Isolating affected systems',
'Resetting exposed accounts'],
'enhanced_monitoring': ['Monitoring domain controllers for '
'unusual privileged access or '
'shadow-copy creation',
'Detecting suspicious file transfers '
'(SMB, HTTPS)',
'Monitoring for credential dumping, '
'DCSync attacks, or forged Kerberos '
'tickets'],
'remediation_measures': ['Rotating KRBTGT keys',
'Disabling NTLM where unnecessary',
'Enforcing Protected Users group '
'policies']},
'title': 'Cyberattackers Target Windows Domain Controllers in Credential '
'Theft Campaign',
'type': 'Credential Theft',
'vulnerability_exploited': 'Volume Shadow Copy Service (VSS) abuse for '
'NTDS.dit file extraction'}