Attackers likely breached the network via a vulnerable VPN, using Mimikatz to steal credentials (caught by Microsoft Defender for Endpoint, which blocked the initial account, User 1). Microsoft has recently uncovered a sharp rise in ransomware attacks exploiting domain controllers (DCs) through Remote Desktop Protocol (RDP), with the average attack costing organizations $9.36 million in 2024. Modern ransomware requires two key elements: high-privilege accounts, such as domain admin credentials, to authenticate across systems, and centralized network access to hit multiple devices simultaneously. Microsoft Defender for Endpoint’s Contain High Value Assets feature tackles this by classifying DCs and containing them in under three minutes if compromised, while preserving critical functions like authentication. DCs’ connectivity lets attackers map networks using tools like BloodHound and deploy ransomware to numerous endpoints. On DC1, they mapped servers with AD tools, disabled antivirus through Group Policy changes, and added two new admin accounts (User 3 and User 4). To address this, Microsoft Defender for Endpoint introduced the Contain High Value Assets (HVA) feature, which enhances its device containment capabilities. This approach proved effective in the Storm-0300 case, where Defender contained compromised accounts and DC1 without disrupting the victim’s AD environment. Attackers use tools like Mimikatz to extract these hashes, enabling pass-the-hash attacks to impersonate domain admins. Microsoft reports that 78% of human-operated ransomware attacks compromise DCs, with 35% using them as the main distribution point. Switching to User 4, they attempted network-wide encryption from DC1, only for Defender to block DC1 and User 4, halting the attack on protected devices. They tried running ransomware on DC1, but Defender contained User 2, User 3, and the RDP-connected device. Attackers exploit exposed RDP ports with brute-force attacks, stolen credentials, or flaws like BlueKeep (CVE-2019-0708). Once inside, RDP’s interface lets them deploy tools and access DCs directly, as seen in the Storm-0300 attack.
This Cyber News was published on cybersecuritynews.com. Publication date: Sat, 12 Apr 2025 04:45:28 +0000