Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain
Attackers broke into a US company's Windows network, turned off security tools, and used Sliver malware to steal passwords and take control of 18 computers. They created a fake admin account to keep access even if the company fixed other breaches.
- Report priority
- High
- Victim
- Windows
What is known
- Attackers first broke into the company's network through an exposed server.
- Once inside, they used Sliver malware to steal passwords and disable security software.
- They created a fake admin account with a password that never expires and added it to the highest-level group, Domain Admins.
- This lets them keep control even if the company removes other attackers or resets passwords.
What to do
If you work for that company, check if your IT team has reported unusual activity or disabled security tools. If you're not part of that company, you are not affected by this specific incident.
If you work for the unnamed US company, contact your IT team immediately. Ask them to review recent security alerts, check for unauthorized admin accounts, and remove any suspicious software. If you're not part of that company, no action is needed unless your IT team advises otherwise.
Reported details
Attackers sent a fake email with a malicious link to a company employee. When clicked, it installed Sliver malware on their computer. From there, the malware stole their login details and spread to other computers in the network, disabling security tools and creating a backdoor for future access.
This campaign demonstrates a multi-stage compromise of a Windows domain, where attackers used Sliver, a post-exploitation framework, to establish persistent control. After gaining an initial foothold, likely via an exposed server, they disabled endpoint protection by stopping eight associated services, collected registry hives (SAM, SYSTEM, SECURITY) for offline password cracking, and extracted credentials via LSASS dumps and Mimikatz. They created a non-expiring Active Directory account with Domain Admin privileges, enabled RDP with NLA disabled, and scheduled SYSTEM-level tasks to maintain persistence, including a weekly payload update mechanism akin to EtherRAT. The operation, tracked as UTA-2026-024 by The Hunter's Ledger, targeted an unnamed US organization but did not deploy ransomware in this instance.