Topic
Microsoft's directory service for Windows networks, a frequent target of privilege-escalation attacks and misconfigurations like MachineAccountQuota.
Intcube CTO David Fuhr says 27 municipalities hardened Windows Server and Active Directory together over 12 weeks, after the firm planned for 10 to 15. He says what one- and two-admin teams lack is motivation, and that a group schedule with start and end measurements supplies it.
Reality
An Akira affiliate began spraying passwords at a SonicWall SSL VPN on August 4, 2026, and one worked about seven minutes later. The account had no MFA, and the ransomware deployment that followed failed after credentials and file-share data were already stolen.
Reality
Federal prosecutors announced a 32-month sentence for a former employee who set about 16 scheduled tasks on a domain controller and demanded 20 BTC. The attacker used a legitimate admin account and standard tools, so the signals to catch were an unauthorized VM and the gap before the tasks ran.
Reality
A fast SOC cut off the intrusion in minutes. The red team still reached the domain controller and the control network, because every control that failed afterwards was a permission somebody granted and nobody had reviewed.
Perspective Coverage
3 publishersReality
Daniel Rhyne got 32 months in federal prison for planting scheduled tasks on his industrial employer's domain controller that locked the firm out. Access to that one server let a single engineer delete or reset 318 accounts and change local administrator passwords on 3,538 machines.
Reality
Daniel Rhyne, a former infrastructure engineer, got 32 months in prison for using domain controller tasks to lock out 254 servers and 3,284 workstations. He staged it over 17 days of unauthorized access, and administrators learned of it from password-reset notifications after the tasks ran.
Perspective Coverage
5 publishersReality
Microsoft patched CVE-2026-69730, a CVSS 9.8 remote code execution flaw in the Windows DNS Server role reachable with one unauthenticated packet to port 53. In most Active Directory shops that role runs on the domain controller, so the box answering on port 53 also holds the identity database.
Reality
Symantec says Warlock operators ran an AV/EDR killer across at least 40 machines in roughly two hours after a suspected SharePoint compromise. The ransomware payloads moved between domain controllers through SYSVOL replication.
Reality
Detection at the first hop forced CISA's red team onto donated access at Organization B. It did not stop the team reaching the same sensitive systems it reached at Organization A.
Perspective Coverage
5 publishersReality
GreyNoise and Blackpoint Cyber trace the new PaperCut auth-bypass chain to one scanning address running AI agents against schools, which turns an unpatched print server from a maintenance ticket into a credential incident.
Perspective Coverage
6 publishersReality
Kaspersky's responders found no encrypted files and no malware on disk across the Windows estate of a Middle East manufacturer in April 2026. The impact arrived through one Group Policy Object linked at the domain root.
Reality
Australia's ASD ACSC wrote the guidance with CISA, the NSA, Canada's CCCS and the British and New Zealand cyber centres, pairing the 17 most common Active Directory compromise techniques with mitigations.
Reality
Huntress's second post on Active Directory Rights Management Service traces every protected document back to one private key. The certificate runs 255 years, the key has no expiry, and the product ships no way to rotate it.
Reality
GreyNoise says a likely Russian-speaking actor built and tested PaperCut exploits in a lab, then ran hundreds of agents on a Codex harness with a DeepSeek model against 440 servers in 48 countries. The sending infrastructure was already on its watchlist.
Reality
Six weeks of lab work on a role Microsoft no longer develops but still supports on Windows Server 2025 ended with an offline decrypt of a protected document and a private key stamped valid until 2258 that nobody can rotate.
Reality
A public proof-of-concept for CVE-2026-54121 shows an Enterprise CA vouching for a forged Domain Controller identity. Microsoft's July 14 fix adds a missing check, not judgement.
Reality