Domain Controller Compromise and Estate-Wide Encryption

Domain controller compromise is the most comprehensive form of ransomware damage, because the attacker no longer has to break into each host — they hold legitimate administrative credentials and can distribute the encryptor estate-wide using the very tools administrators use (Group Policy, PsExec, WMI, SCCM, remote scheduled tasks). It is fast, complete, and in the logs it looks like ordinary operations.

The typical chain: an initial foothold from exposed RDP, a VPN, a web application flaw or a phishing email; local privilege escalation and credential harvesting from memory; lateral movement in search of privileged accounts; DCSync or a direct NTDS.dit export to obtain hashes for the whole domain; domain administrator rights; and then delete backups, disable antivirus, clear logs, and deploy estate-wide. In publicly documented cases, attackers have also bypassed technical controls entirely through social engineering, impersonating an employee to a service desk to obtain a password reset.

Three things make these incidents distinctive:

• Recovery must begin at the identity layer. Data can be restored from backup, but if Active Directory itself is not clean and credentials have not been comprehensively reset, restored systems will simply be re-encrypted. Identity first, data second — the order cannot be reversed.
• "Clean up or rebuild" is a judgement that must actually be made. Where the attacker achieved domain administrator rights and may have exported NTDS.dit, they in principle hold credential material for every account, including krbtgt. Password changes alone cannot guarantee eradication, so a domain rebuild — or at minimum a properly executed double krbtgt rotation — must be seriously assessed.
• The backup estate has probably fallen too. A backup server inside the domain, running jobs under a domain administrator account, is dealt with along the way.

Mistakes to avoid: restoring a domain controller from backup and reconnecting it to the network without assessment, declaring safety after a single password change, and rebuilding endpoints with the original domain credentials. We do not recommend paying, and we do not negotiate on your behalf.

• Adopt a tiered administration model. Domain administrator accounts must never log on to ordinary endpoints and servers; administrative work happens on privileged access workstations. Keep day-to-day accounts strictly separate from privileged ones.
• Strong authentication for privileged accounts. Enforce MFA on every administrator account, restrict where and when they can log on, and audit membership of Domain Admins, Enterprise Admins and similar groups regularly.
• Suppress lateral movement. Deny SMB / RDP between endpoints by default, randomise local administrator passwords with a LAPS-style solution, restrict the sources permitted to use WinRM / WMI remote execution, and apply network segmentation and host firewalls.
• Protect credentials. Enable Credential Guard, disable WDigest where unnecessary, limit delegable accounts, and monitor for DCSync-style directory replication requests and anomalous Kerberos ticket requests.
• Harden the service desk process too. In publicly documented cases, attackers bypassed technical controls by impersonating an employee on a call to the service desk and obtaining a password reset. Password resets and MFA re-enrolment need robust identity verification.
• Take the backup estate out of the domain. Keep backup servers unjoined, with separate credentials and network, immutable backups enabled and an offline copy retained. Store domain controller system-state backups offline separately — they are the precondition for forest recovery.
• Full EDR coverage with tamper protection. Watch especially for anomalous Group Policy changes, new executables in SYSVOL, bulk remote execution, shadow-copy deletion and antivirus uninstallation — the last signals before estate-wide deployment.
• Drill AD recovery. Rehearse the forest recovery procedure in an isolated environment at least annually to prove backup usability and build operator fluency; doing it for the first time during a real incident is extremely costly.