Identity Attack Watch: December 2022

By Semperis Research Team December 30, 2022 | Active Directory

Cyberattacks targeting Active Directory are on the upswing, putting pressure on AD, identity, and security teams to monitor the constantly shifting AD-focused threat landscape. To help IT pros better understand and guard against attacks involving AD, the Semperis Research Team offers this monthly roundup of recent cyberattacks that used AD to introduce or propagate malware.

This month, the Semperis Research Team highlights new attacks by LockBit on public entities in California and Portugal, a Hive attack on a Louisiana hospital, and a BlackCat attack on Colombian energy supplier EPM.

LockBit claims attack on Port of Lisbon

The LockBit ransomware group claimed a Christmas Day attack on the Port of Lisbon in Portugal that compromised data but did not affect the port’s operations, although the port’s official website went offline. The port, considered critical infrastructure, is one of the most accessed in Europe, serving container ships, cruise ships, and pleasure boats. LockBit also recently claimed responsibility for an attack on the California Department of Finance. The LockBit group uses various tactics, techniques, and procedures (TTPs) to compromise victim organizations, including abusing AD group policies to encrypt devices across Windows domains.

Read more

Hive ransomware group claims attack on Louisiana hospital

The Hive ransomware group claimed responsibility for an October ransomware attack on Lake Charles Memorial Health System in Louisiana that compromised data of about 270,000 patients. Among other tactics, Hive uses remote admin software to infiltrate systems and establish persistence, then deploys tools such as ADRecon to map the AD environment.

Read more

BlackCat ransomware group hits Colombian energy supplier EPM

A BlackCat/ALPHV attack on Colombian energy supplier EPM took down operations of one of the country’s largest providers of public energy, water, and gas.  Microsoft recently warned that the BlackCat ransomware group targets Exchange servers to gather Active Directory information needed to compromise the environment and drop file-encrypting payloads.

Read more

More resources

About the author
Semperis Research Team
Semperis Research Team
The Semperis Research Team continuously studies the ways cyber criminals are plotting to compromise organizations' information systems—particularly by exploiting vulnerabilities in Active Directory—now and in the future. Their work provides guidance for the security community in protecting against AD-related attacks and informs the development of products that help organizations increase their cyber resilience. Linkedin
Unlock cyber resilience. Get a demo