Hot Takes: Inside a Microsoft Ransomware Attack

This "loiter and harvest" behavior — spending significant time inside the network before taking disruptive action — mirrors tactics seen from other threat actors such as Volt Typhoon, although the motivations and follow-on actions differ (nation-state pre-positioning vs. criminal ransomware monetization).

The most consequential technical event in this attack was the exfiltration of the Active Directory database. Once an attacker has a copy of this database, they effectively hold "the keys to the kingdom": every account's password hash can be cracked or relayed offline, at leisure, without triggering account lockout policies or other live-network detections.

With cracked or replayed credentials in hand, the attackers were able to move laterally across the network largely undetected, because they were authenticating as legitimate accounts rather than exploiting a technical vulnerability at each hop. This is why credential-focused attacks against identity infrastructure are considered so much more dangerous than a single-host compromise: capturing the domain's credential material collapses the effort needed for lateral movement across the entire environment down to almost zero.