Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain
Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain
摘要: Home
Cyber Security News
Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain
Tushar Subhra Dutta
September
正文
Cyber Security News
Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain
Tushar Subhra Dutta
September 8, 2026
A new intrusion campaign shows how quickly a Windows domain can be turned into a launchpad for deeper compromise. The operators used a Sliver command-and-control beacon, account creation, credential theft and remote administration to establish control after gaining an initial foothold.
The activity was staged from an exposed server and aimed at one unnamed US organisation. Its scripts were built for a real Active Directory environment, including a planned rollout across 18 hosts, while the recovered material contained no proof that ransomware was deployed in this specific incident.
Analysts at The Hunter’s Ledger identified the operation as a high-risk post-exploitation toolkit and tracked it as UTA-2026-024.
The research ties the infrastructure to a confirmed ransomware incident, but does not name the people behind this intrusion or conclude that they deployed an encryptor.
The Hunter’s Ledger said in a report
shared with Cyber Security News (CSN) that the operators combined ordinary public tools with unusually detailed knowledge of the victim’s network.
The result was a durable access package designed to disable safeguards, steal credentials and keep its control channels available.
Hackers Disable Endpoint Protection
After entering the domain, the operators scripted the creation of an Active Directory account with a non-expiring password and added it directly to Domain Admins.
They also created a local administrator, enabled Remote Desktop Protocol access, and turned off Network Level Authentication, expanding the paths available for later movement.
The scripts stopped and disabled eight services associated with the victim’s endpoint protection product, then checked each service state.
They also collected the SAM, SYSTEM and SECURITY registry hives for offline password cracking, while a separate