Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain
The Hunter's Ledger tracked campaign UTA-2026-024 using Sliver C2, Domain Admin account creation, and Ethereum-based C2 rotation to compromise a US organization's Windows domain.
The Hunter's Ledger tracked an intrusion at one unnamed US organization as UTA-2026-024, staged from exposed server 193.233.202.17 with a Sliver beacon. Operators created a non-expiring Domain Admin account, enabled RDP with NLA disabled, dumped SAM, SYSTEM and SECURITY hives plus LSASS memory, and disabled eight endpoint protection services. A Node.js implant resolved its C2 server from an Ethereum smart contract that rotated domains five times in five months, while SYSTEM scheduled tasks with backdated dates and DNS allowlist manipulation provided persistence. The infrastructure ties to a confirmed ransomware incident, but no encryptor deployment was proven in this intrusion.
- Created AD account with non-expiring password added to Domain Admins
- Stopped and disabled eight endpoint protection services via scripts
- Dumped SAM, SYSTEM, SECURITY hives plus LSASS memory for cracking
- Node.js implant resolved C2 domains from an Ethereum smart contract
- Modified DNS allowlist and internal DNS to legitimize attacker domain
- Vendors
- SliverMimikatzPrintSpoofer
- Products
- Active Directory
- Threat actors
- UTA-2026-024
- Malware
- Sliver
- Organizations
- The Hunter's Ledger
- Countries
- US
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | itemrange.com | ystarting.com Historical Ethereum resolver C2 domain Domain itemrange.com Most recently recorded Ethereum resolver C2 domain URL http |
| domain | publisherresolution.com | sed address from April 2026, designated monitor-only Domain publisherresolution.com First C2 domain written to the Ethereum resolver contract D |
| domain | resumeacceptable.com | C2 domain written to the Ethereum resolver contract Domain resumeacceptable.com Historical Ethereum resolver C2 domain Domain simultaneousl |
| domain | simultaneouslypower.com | cceptable.com Historical Ethereum resolver C2 domain Domain simultaneouslypower.com Historical Ethereum resolver C2 domain Domain wiselystartin |
| domain | wiselystarting.com | uslypower.com Historical Ethereum resolver C2 domain Domain wiselystarting.com Historical Ethereum resolver C2 domain Domain itemrange.com |
| ipv4 | 146.103.127.44 | rd-tier fallback address, designated hunt-only IPv4 address 146.103.127.44 Historical operator-used address from April 2026, designate |
| ipv4 | 193.233.202.17 | compromise (IoCs):- Type Indicator Description IPv4 address 193.233.202.17 Primary Sliver command-and-control and staging-server addre |
| ipv4 | 77.110.126.46 | command-and-control and staging-server address IPv4 address 77.110.126.46 Hardcoded third-tier fallback address, designated hunt-only |
From the original article
4 min read at cybersecuritynews.com
A new intrusion campaign shows how quickly a Windows domain can be turned into a launchpad for deeper compromise. The operators used a Sliver command-and-control beacon, account creation, credential theft and remote administration to establish control after gaining an initial foothold. The activity was staged from an exposed server and aimed at one unnamed US […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.