Hackers publish work details on more than 41,000 DHS employees
The Icepick dump lists ICE, CBP and CISA contacts and internal groups; DHS calls it a potential breach.
76
Product
Active Directory
- Mentions · 7d1
- Mentions · 30d13
- All mentions25
- First seenSep 8, 2026
- Last mentioned13h ago
Timeline
25 articles · newest firstRansomware crews threatened employees' families at 37% of surveyed firms
Semperis surveyed 1,200 professionals at organizations already hit; 59% paid and 87% saw identity systems targeted.
54
Why Active Directory weaknesses stay open for years in teams with one or two admins
intcube led 27 municipalities through a 12-week program to harden Windows Server and Active Directory.
28
Ransomware Attacks Intensify: Criminals Shift Focus to Target Employees and Their Families
Semperis says 37% of successful ransomware attacks included threats against employees’ friends or relatives.
74
AI Used in 84% of Ransomware Attacks as Identity Infrastructure Comes Under Fire.
Semperis survey of 1,200 ransomware victims finds AI in 84% of incidents and identity systems widely targeted.
64
Multiple Active Directory Vulnerabilities Let Attackers Bypass Security Feature Remotely
Microsoft disclosed three remote Active Directory security-feature bypass flaws, with no evidence of active exploitation.
68
Microsoft VSS: Still Essential, But Not the Whole Story
Huntress details Microsoft VSS limits, including a 64TB cap and ransomware deletion of local snapshots.
32
Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)
Microsoft’s October 2026 Patch Tuesday fixes 1,407 CVEs, including an exploited Windows Shell zero-day.
82
October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
Microsoft's October 2026 Patch Tuesday patches 1,417 flaws, including an already exploited Windows Shell bypass.
82
No Identity, No Recovery: Cyber Resilience Starts With IAM
Analyst says identity resilience is essential to recover operations after ransomware and outages.
30
UK and Allies Warn of Cyber Threat from China’s Integrity Technology Group
Allies warn Integrity Technology Group enables China-backed intrusions, email theft, and related hacking tools.
78
One breach, please, and make no mistakes
Cisco Talos says AI agent swarms already attack infrastructure and defenders must rehearse quieter campaigns.
60
tenfold CE: Our free Identity Governance tool just got 2 new features
tenfold's free Community Edition IGA tool adds Microsoft 365 sharing reviews and identity event auditing.
16
Windows 11 26H1 Security Update Expands Secure Boot Certificate Protection
Microsoft's Windows 11 26H1 update KB5124012 widens Secure Boot certificate deployment and patches two elevation flaws.
54
One Stolen Active Directory File Can Expose Credentials for an Entire Windows Domain
Trellix warns that stealing a domain controller's NTDS.dit and SYSTEM hive can expose an entire Windows domain's credentials.
44
NightEagle Uses BlueKeep and DCSync to Move Toward Active Directory Domain Controllers
NightEagle espionage group used GhostContainer, BlueKeep exploitation, and DCSync attempts to compromise Russian organizations and target Active Directory controllers.
75
PAYLOAD Ransomware Abuses Active Directory Group Policy to Disrupt Entire Windows Domain
PAYLOAD ransomware abused Active Directory Group Policy to disrupt a Windows domain without using file encryption.
75
Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
Kaspersky details PAYLOAD ransomware operators abusing Active Directory GPOs for encryptionless extortion at a Middle East manufacturer, exfiltrating data published on the dark web.
72
Windows 11 KB5124008 Update Breaks Active Directory Domain Trust and Blocks User Logins
Microsoft's September Windows 11 cumulative update KB5124008 breaks Active Directory domain trust on domain-joined machines, blocking logins despite valid credentials.
58
Windows 11 KB5124008 update breaks domain trust for some users
Microsoft is investigating Windows 11 KB5124008 breaking Active Directory domain trust, leaving some users unable to log in with valid credentials.
60
Hackers Pose as Domain Controllers to Steal Active Directory Password Hashes
Attackers abuse Active Directory replication (DCSync) via the DRSUAPI protocol to steal password hashes and forge Golden Tickets for persistent domain compromise.
35
Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers
AI-agent campaign exploited PaperCut CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations and reaching Domain Admin in 12.
82
Patch Tuesday to Pentest Wednesday: How an Equipment Rental Company Is Turning Continuous Testing Into Continuous Exposure Management
An equipment rental company uses Horizon3 NodeZero for continuous exposure management, surfacing an SSH key exposure in eight hours versus annual pentesting.
15
MFA's Weakest Link: Account Recovery Is the New Attack Path
Help desk account recovery is increasingly the weakest link in MFA-protected identities, as Scattered Spider's impersonation-driven Marks & Spencer attack demonstrated.
32
Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain
The Hunter's Ledger tracked campaign UTA-2026-024 using Sliver C2, Domain Admin account creation, and Ethereum-based C2 rotation to compromise a US organization's Windows domain.
45
Related CVEs
by mentions- CVE-2026-9695110%8.8Windows Shell command injection bypasses a security feature
- Untrusted search path in Microsoft .NET Framework
- Network stack buffer overflow RCE in Microsoft Exchange
- CVE-2019-0708100%9.8Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep)
- CVE-2020-0688100%8.8RCE in Microsoft Exchange Server from Shared Install-Time Validation Keys
- CVE-2021-4228777%7.5Privilege Escalation in Microsoft Active Directory Domain Services
- CVE-2026-969403%8.8Weak authorization privilege escalation in Microsoft Exchange Server
- Incorrect authorization RCE in Active Directory Domain Services
- Type confusion privilege escalation in Desktop Window Manager
- CVE-2026-62721<1%7.8Insufficient granularity of access control in User-Mode Power Service (UMPS) allows an authorized attacker to elevate privileges locally
Appears with
- Microsoftvendor · 19
- Microsoftorganization · 8
- Windowsproduct · 6
- Oktavendor · 4
- Entra IDproduct · 4
- Semperisorganization · 3
- Credential Guardproduct · 3
- Windows 11product · 3
- Kasperskyvendor · 3
- .NET Frameworkproduct · 2
- Microsoft 365product · 2
- Fortinetvendor · 2
- PAYLOADmalware · 2
- Microsoft Exchange Serverproduct · 2
- Ciscovendor · 2
- Trellixorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.