Organizations Aren’t Prepared to Recover from Cyberattacks on Active Directory



active directory cyberattack malware Cybercriminals are increasingly leveraging Active Directory to spread malware and even hold the organization for ransom. New data suggests you’re nowhere near ready for it.

I don’t need to say it, but your Active Directory (AD) is mission critical. Nearly every part of your on-premises environment – and some of your cloud environment – depends on the active presence of this directory service.

And the bad guys know it.

I’ve brought up the use of AD a few times this year. We’ve seen AD used to spread Ryuk ransomware to remote endpoints by compromising domain controllers and running a logon script via Group Policy. We’ve also seen ransomware specifically target domain controllers to hold AD for ransom. And anytime you hear about an attack involving lateral movement, it means accounts are compromised, passwords are changed and – if the bad guys can make their way to a privileged account within AD – modifications to AD groups, users, and permissions to establish persistence, stealth, and control.

So, it’s necessary for organizations to be ready to recover both parts of Active Directory that have been modified during a cyberattack, as well as recover their domain controllers.

But according to AD-focused cybersecurity vendor Semperis, in their Recovering Active Directory from Cyber Disasters report, it appears the IT organizations simply aren’t prepared:

  • 84 percent of orgs feel an AD outage would be “significant, severe, or catastrophic”
  • Only 3 percent of orgs are “extremely confident” about their ability to recover AD to new servers should it be necessary
  • Only 15 percent of organizations have actually tested their AD recovery plan in the last six months

With cyberattacks being so prevalent today, increasing in frequency and sophistication, it’s time for organizations to ensure they have a means to recover themselves to not just a known-functioning state, but a known-secure state back before attackers had access to AD.

The bad guys know AD is the keys to the kingdom. You need to work to both prevent its’ compromise, as well as be able to recover it should it be compromised.


Free Ransomware Simulator Tool

Bad guys are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?

KnowBe4’s "RanSim" gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 18 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.

RanSimScreen-1Here's how it works:

  • 100% harmless simulation of real ransomware and cryptomining infections
  • Does not use any of your own files
  • Tests 19 types of infection scenarios
  • Just download the install and run it 
  • Results in a few minutes!

Get RanSim!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/ransomware-simulator

Topics: Malware, Ransomware

Subscribe To Our Blog


New call-to-action




Get the latest about social engineering

Subscribe to CyberheistNews