Mandiant detailed an August 4, 2026 Akira ransomware intrusion in which an affiliate brute-forced a SonicWall SSL VPN account that had no multi-factor authentication, gaining access within minutes. The attacker then used RDP to reach the domain controller, enumerate Active Directory, and steal credentials and file-share data, though the ransomware payload itself failed to deploy. Mandiant's 2025 data shows compromised credentials caused 21% of ransomware incidents with a known entry point, and RDP was used for lateral movement in about 85% of cases.
bleepingcomputer.com
· 2026-10-13
Microsoft confirmed it is investigating reports that the Windows 11 KB5124008 security update is severing secure channel connections between domain-joined PCs and Active Directory after a reboot, locking out users with valid credentials. Administrators on Reddit and Microsoft's Q&A forums say the problem appears tied to the Windows Machine Identity Isolation feature when running in audit or enforcement mode, and that uninstalling the patch and repairing the domain trust restores access.
bleepingcomputer.com
· 2026-09-16
GreyNoise reports that a suspected Russian-speaking threat actor deployed hundreds of AI agents, trained in a lab, to hunt down internet-exposed PaperCut NG and MF servers and exploit two known vulnerabilities. The campaign hit at least 440 instances across 395 organizations in 48 countries, with attackers pivoting from initial compromise toward Windows Active Directory environments.
darkreading.com
· 2026-09-11
GoKawiil