ClickFix campaigns hide executables in PNG images
Huntress says separate operators used ClickFix to reach domain controllers, steal access, and persist via tasks and Run keys.
Stories per day · 30 days
2 RSS
4 stories, newest first · one card per story
Stories tagged #domain-controller
Former Infrastructure Engineer Sentenced for Sabotaging Employer’s Windows Network
Daniel Rhyne was sentenced to 32 months for sabotaging a New Jersey company’s Windows network and demanding bitcoin.
2
Hackers Abuse VSSAdmin to Extract NTDS.dit and Delete Windows Recovery Copies
Huntress details intruders using PsExec and VSSAdmin on domain controllers to steal NTDS.dit credentials and delete shadow copies before ransomware.
1
2026-007: Critical Vulnerability in Windows Netlogon
Actively exploited CVSS 9.8 Windows Netlogon flaw lets unauthenticated attackers execute code with SYSTEM privileges on domain controllers.
4