In a disturbing escalation, cybercriminals are now stealing the NTDS.ditfile—the Active Directory database—from compromised Windows domain controllers. This move lets them extract password hashes and Kerberos keys for every account in the domain, enabling powerful tactics like pass-the-hash attacks and Golden Ticket forgery. These threats aren’t theoretical: in lab simulations conducted by security researchers, the full chain—from initial access to full credential exfiltration—was achieved.
How Attackers Reach the Domain Controller
The breach begins with typical entry vectors: spear-phishing, malicious Office macros, weaponized shortcut files, or compromised installers. Once malware is inside, it escalates privileges to the SYSTEM level and scans for credentials already resident in memory. With those elevated permissions, the attacker begins targeting the NTDS database.
Normally locked during system operation, the Active Directory database becomes available once attackers abuse Windows’ Volume Shadow Copy Service to make a readable copy. They also steal the matching SYSTEM registry hive, which holds a key needed to decrypt the NTDS.dit file offline. What’s taken includes NTLM hashes, Kerberos keys, and password histories.
From Hash Dumping to Golden Tickets
After the database is stolen, attackers don’t necessarily have to crack every password. Valid hashes alone can enable pass-the-hash techniques, letting them impersonate users or move laterally across systems. More dangerously, accessing the KRBTGT account secret can allow forging Golden Tickets—Kerberos tickets that grant persistent, high-level access until key rotation occurs.
Transferring the stolen data typically involves SMB or remote administration tools, followed by HTTPS exfiltration to attacker-controlled infrastructure. All this can take place while blending in with normal Windows behavior.
Detect, Prevent, Respond
Defenders are advised to monitor for behavior rather than rely solely on detecting known malware. Key signs include suspicious privileged access, use of shadow copies, large file collections from system directories, and unusual outbound traffic.
Organizations should limit who can use Volume Shadow Copy Service, eliminate unnecessary NTLM authentication, enforce directory controller logging, and audit replication and DCSync activity. Placing critical accounts into Protected Users, resetting exposed privileged accounts, and rotating the KRBTGT key after compromise are essential defensive steps.
Once a breach is suspected, simply deleting malware isn’t enough. Teams must assess which systems were reached with stolen credentials, analyze logs for misuse of forged tickets, and verify whether the NTDS.dit file left the network.
The striking takeaway: once adversaries reach the domain controller, they hold the keys—literally and figuratively—to identity infrastructure. The best defense lies in catching them earlier through anomaly detection and strict identity hygiene. We should expect these attacks to become a standard playbook for high-impact intrusions going forward.
