Ransomware Hackers Target Active Directory Domain Controllers

Ransomware hackers are hitting up Active Directory domain controllers to boost privileges within compromised networks, warns Microsoft.

See Also: Top 10 Technical Predictions for 2025

Nearly eight out of every 10 human-operated cyberattacks involves a breached domain controller, the computing giant said in a Wednesday blog post. In more than three out of 10 hacks, the system responsible for distributing crypto-locking software across a corporation is a domain controller.

A compromise of domain controllers allows hackers to extract password hashes for every user account, which they can use to identify high-privilege accounts, such as those of the IT admins. By manipulating these accounts, the attackers can escalate privileges.

“This level of access enables them to deploy ransomware on a scale, maximizing the impact of their attack,” Microsoft said.

In one case observed by Microsoft, a hacking group it tracked as Storm-0300 attempted to carry out a ransomware attack after gaining initial access through the target’s virtual private network.

The hacker gained admin credentials and attempted to connect to the domain controller using remote desktop protocol. The hackers proceeded to conduct reconnaissance, security evasion, as well privilege escalation.

Microsoft adds that despite increasing attacks targeting domain controllers, securing the servers is a challenge due to their central role in network security.

The servers need to authenticate users and to manage resources, so the challenge for network defenders often is “striking the right balance between security and operational functionality.”

Building capabilities that will allow domain controllers to distinguish between malicious and benign behavior is a potential step to avoid the server compromise, Microsoft said.

While Microsoft provides “robust defenses,” their effectiveness relies on customers regularly patching and enabling multifactor authentication, said Jason Soroko, a senior fellow at security firm Sectigo.

“Ultimately, even the most advanced defense mechanisms may falter if misconfigured or if legacy systems create vulnerabilities. Hence, vigilant customer-side security practices is critical to fortifying these systems against modern cyber threats,” Sectigo said.