An escalating Windows domain compromise has exposed how attackers can rapidly dismantle defenses and secure persistent access. In this latest campaign, operators disabled endpoint protection, deployed Sliver command-and-control beacons, stole credentials, and conducted remote administration after obtaining an initial foothold in a U.S.-based organization. Attackers built scripts for real Active Directory systems, with planned expansion over 18 hosts, yet no evidence has been found that ransomware was actually deployed during this intrusion.
From Initial Breach to Deep Control
After gaining access via an exposed server, the threat actors created an Active Directory account assigned to Domain Admins with a password that does not expire. They set up local administrative accounts, enabled Remote Desktop Protocol (RDP) access, and disabled Network Level Authentication, opening up multiple avenues for lateral movement. Key defenses were neutralized when scripts stopped and disabled eight services tied to the endpoint protection product, then verified each was inactive.
To harvest credentials, they acquired the SAM, SYSTEM, and SECURITY registry hives for offline cracking, conducted an LSASS memory dump, and used tools like Mimikatz. To ensure persistence, they established scheduled tasks running as the SYSTEM user, with forged author metadata and backdated registration. One task executed weekly, fetching the latest attack chain without storing a fixed payload—a fileless delivery method easing stealth across the network.
Clever C2 Setup and Tactics
Alongside Sliver, the attackers employed a Node.js implant that retrieves its command server address via an Ethereum smart contract. The domain stored in that contract matched an entry the intruders inserted into the victim’s internal DNS configuration, allowing them to bypass content filters. Although the contract changed the domain five times over five months, its identity remained constant and visible, giving defenders a foothold for tracking. The Sliver beacon also connected every 60 seconds without variation, a sign enabling pattern-based detection.
The recommended response includes a full credential reset across the compromised domain—not just for known accounts—reviewing members added to privileged groups, removing malicious scheduled SYSTEM tasks, restoring DNS allowlist settings, rotating the content filter admin password, and deleting injected internal DNS entries. Security teams are urged to determine where RDP is enabled without Network Level Authentication and to monitor the smart contract for domain changes. Detection strategies should be based on behavior rather than relying solely on signatures; examples include tracking sudden changes to endpoint protection services and scheduled tasks executing with elevated privileges.
Indicators of Compromise (IoCs) tied to this campaign span IP addresses such as 193.233.202.17 (primary Sliver C2), fallback and historical addresses like 77.110.126.46 and 146.103.127.44, domains used in an Ethereum resolver contract (including publisherresolution.com and its successors), specific payload file names (e.g., task_39.ps1, slv_beacon_sc.bin), smart contract addresses, and consistent installer identifiers.
This campaign was tracked under designation UTA-2026-024 by researchers, who noted links to a confirmed ransomware incident but did not confirm an encryptor’s deployment in this case. The infrastructure showed attackers combining off-the-shelf utilities with deep internal understanding of Active Directory environments to build resilient access.
What this reveals is how attackers are increasingly chaining familiar tools—account creation, endpoint protection disabling, credential exfiltration—with strategic persistence measures. These aren’t isolated incidents but intricate operations built for long haul control. Organizations must rethink defense not just at the network edge, but map out the sequence of what advanced adversaries actually do once inside.
