All news with #active directory tag

🔐 This Unit 42 report examines how misconfigured Active Directory Certificate Services (AD CS) components create high-impact attack surfaces that enable privilege escalation, identity impersonation, and persistent access. It details exploitation techniques—especially certificate template misconfigurations and shadow credential abuse—tools observed in the wild, and a five-phase adversary lifecycle. The report emphasizes behavioral detection, telemetry correlation, and mitigation guidance to help defenders close monitoring gaps.

🔒 AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) now offers expanded STIG-aligned security settings focused on high-impact directory controls. These settings are available today through a self-service interface, both programmatically and via the AWS Management Console, enabling administrators to declare desired configurations and have AWS implement and persist them. When new domain controllers are added or directories are scaled or deployed in additional regions, AWS automatically applies the declared settings to new instances to maintain consistency.

🔒 In February 2026 researchers flagged a major shift: threat actors now deploy custom AI agents that automate attacks through the kill chain, from Active Directory mapping to rapid Domain Admin takeover. Join a technical webinar with Picus Security leaders Kevin Cole and Gursel Arici for a deep dive into Autonomous Exposure Validation. Learn how to safely ingest threat intelligence, simulate attacks, and close the gap between CTI, Red, and Blue teams to speed detection and remediation.

🔒 AWS has automatically upgraded all AWS Managed Microsoft AD directories to the Windows functional level 2016, effective Apr 20, 2026. The update delivers enhanced authentication and improved privileged access management and enables built-in LAPS to generate unique, complex local administrator passwords stored securely in Active Directory. The upgrade is applied in all Regions where the service is available, except Middle East (UAE) and Middle East (Bahrain). See the AWS Directory Service Administration Guide for details.

⚠️After installing the April 2026 Windows security update (KB5082063), some non‑Global Catalog domain controllers configured with Privileged Access Management (PAM) may experience Local Security Authority Subsystem Service (LSASS) crashes during startup. Affected servers can enter repeated reboot loops, disrupting authentication and directory services and potentially rendering domains unavailable. Microsoft is investigating and advises administrators to contact Microsoft Support for Business for mitigation options until a permanent fix is released.

🔒 A core infrastructure engineer, Daniel Rhyne, pleaded guilty on April 1 after launching an insider extortion attack that used routine admin tools and techniques to disable systems and accounts. He initiated unauthorized RDP sessions, deleted administrator accounts, changed passwords, and scheduled tasks on the domain controller, then claimed to have erased backups while demanding roughly $750,000 in bitcoin. Security experts say the methods were alarmingly predictable and could have been prevented by immutable backups, strict least privilege controls, and behavioral alerts for high‑risk tools.

🔁 AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) now supports Multi-Region replication in AWS Opt-In regions. The automated feature deploys domain controllers across Availability Zones per region, handles inter-region networking, and replicates users, groups, Group Policy Objects, and schema to maintain a single authoritative directory. It configures an Active Directory site per region to optimize authentication performance and reduce cross-region transfer costs; availability excludes the Middle East (UAE) and Middle East (Bahrain) regions and pricing is hourly per domain controller plus data transfer.

🔒 CrowdStrike outlines detection for CVE-2026-20929, a Kerberos relay vulnerability exploited via DNS CNAME abuse that can enroll certificates from Active Directory Certificate Services (AD CS). Their correlation-based detection flags anomalous certificate-based authentications coincident with unusual AD CS Kerberos service access within a short time window. Customers can enable the provided CRT rule in Falcon Next‑Gen SIEM to activate alerts and support hunting.

🔐 Ransomware has shifted boardroom and security priorities by showing that identity compromise can block recovery even after applications and data are restored. Security leaders now treat identity recovery as a designed capability, emphasizing immutable backups, automated restoration for Active Directory, and isolated backup platforms. Vendors such as Cognizant and Rubrik are positioning integrated services that combine orchestration, rapid recovery, and compliance-ready reporting to shorten downtime and reduce attacker re-entry risk.

🔐 The article provides a practical, technical roadmap for eliminating passwords in hybrid Active Directory and Microsoft Entra ID environments. It emphasizes the prerequisite triangle of cloud Kerberos trust, device registration, and Conditional Access, then compares architectural choices like Windows Hello for Business, FIDO2 keys, and phone sign-in. The author presents phased migration steps, common troubleshooting patterns, and recovery best practices to help organizations move securely toward Zero Trust.

🔒 Hybrid work has driven a sharp rise in Active Directory password resets as cached credentials, inconsistent network connectivity, and stricter rotation policies cause more account lockouts. IT helpdesks supporting distributed employees are inundated with routine tickets that drain resources and reduce productivity. Forrester estimates a $70 cost per reset, and Specops data shows an average organization handles 923 resets annually. Implementing self‑service password reset solutions like Specops uReset can reduce wait times and restore access quickly.

🔒 Cisco Talos describes an actor tracked as UAT-8837, active since at least 2025, that targeted North American critical infrastructure to gain initial access. The group exploited both compromised credentials and a Sitecore ViewState deserialization zero-day (CVE-2025-53690), with Mandiant linking the flaw to deployment of the WeepSteel reconnaissance backdoor. Post-compromise activity focused on credential theft, Active Directory enumeration, and use of living-off-the-land utilities and open-source tools to evade detection.

⚠️ Cisco Talos says a China-aligned advanced persistent threat tracked as UAT-8837 has been leveraging a critical Sitecore zero-day (CVE-2025-53690, CVSS 9.0) to gain initial access to North American critical infrastructure. The actor uses both exploit-based access and compromised credentials, then deploys open-source tools for credential harvesting, Active Directory reconnaissance, and persistent remote access. Observed artifacts include GoTokenTheft, EarthWorm, DWAgent, SharpHound, Impacket, Rubeus, and Certipy, raising supply chain and OT exposure concerns.

🔍 Cisco Talos is tracking UAT-8837, an assessed China-nexus APT that since 2025 has focused on obtaining initial access to high-value and critical infrastructure organizations in North America. The actor uses both n-day and zero-day exploits (including CVE-2025-53690 in SiteCore) and often deploys open-source tooling—Earthworm, SharpHound, DWAgent, Certipy, and GoTokenTheft—to harvest credentials, enumerate Active Directory, and create remote tunnels. Operators perform hands-on-keyboard reconnaissance, create backdoored accounts and remote admin access, and cycle tools when endpoint protections block their payloads. Talos provides IOCs, Snort rules, and ClamAV signatures to detect and mitigate this activity.

🔐 Generative AI is accelerating password attacks against Active Directory, making cracking cheaper, faster, and more targeted than traditional techniques. Models like PassGAN learn real-world password patterns and can predict employee passwords when trained on breach data or public company content. Combined with readily available GPU cloud rentals, attackers can test vastly more candidates and tailor guesses using org-specific reconnaissance. Vendors such as Specops recommend longer, random passphrases and breached-password screening to reduce exposure.

🔒 Kerberoasting remains a persistent threat to Active Directory environments, enabling attackers to request service tickets for SPNs and crack their password hashes offline to escalate privileges. Adversaries use freely available tools like GetUserSPNs.py and Rubeus to extract tickets tied to service accounts, then perform offline brute-force attacks against the ticket encryption. Mitigations recommended include regular AD password audits, using gMSAs with auto-managed long passwords, preferring AES over RC4, enforcing non-reusable 25+ character passwords with rotation, and deploying MFA and robust password policies.

🔐 Active Directory remains the critical authentication backbone for most enterprises, and its growing complexity across on‑premises and cloud hybrids has expanded attackers' opportunities. The article highlights common AD techniques — Golden Ticket, DCSync, and Kerberoasting — and frequent vulnerabilities such as weak and reused passwords, lingering service accounts, and poor visibility. It recommends layered defenses: strong password hygiene, privileged access management, zero‑trust conditional access, continuous monitoring, and rapid patching. The piece stresses that AD security is continuous and highlights solutions that block compromised credentials in real time.

🔍 Varonis responded after a server CPU spike exposed an active intrusion later attributed to RansomHub affiliates. The attacker gained initial access via a SocGholish JavaScript masquerading as a browser update, then deployed a persistent Python-based SOCKS proxy and automated reconnaissance to hunt credentials and enumerate Active Directory. Within hours the actor obtained Domain Admin privileges and initiated broad discovery and exfiltration; Varonis developed an unpacker, identified IOCs, and coordinated containment and remediation that prevented ransomware with zero downtime.

🔐 Today, CISA, in collaboration with the National Security Agency and international partners, published Microsoft Exchange Server Security Best Practices to help defenders harden on-premises Exchange servers against ongoing exploitation. The guidance emphasizes strengthening user authentication and access controls, enforcing robust network encryption, and reducing application attack surfaces through configuration and feature management. CISA also urges organizations to decommission end-of-life or hybrid 'last Exchange' servers after migrating to Microsoft 365 to reduce exposure to continued exploitation.

🔒 CISA, the NSA, and international partners released the Microsoft Exchange Server Security Best Practices blueprint to help administrators of on‑premises and hybrid Exchange environments strengthen defenses against persistent cyber threats. The guidance builds on CISA’s Emergency Directive 25‑02 and emphasizes restricting administrative access, implementing multifactor authentication, enforcing strict transport security, and adopting zero trust principles. It also urges organizations to remediate or replace end‑of‑life Exchange versions, apply recommended mitigations, and consider migrating to cloud-based email to reduce operational complexity and exposure.