Ransomware containment depends on defending the identity core

At a glance

What this is: This article argues that ransomware now aims for Active Directory and domain controllers because the identity core gives attackers the fastest route from foothold to enterprise-wide control.

Why it matters: IAM, PAM, NHI, and Zero Trust teams need to treat identity infrastructure as a containment boundary, because once trust services fall, lateral movement becomes systemic.

Context

Active Directory is the trust engine for many enterprise environments. It stores the relationships that determine who can authenticate, what they can access, and which systems can be trusted to make access decisions.

This article focuses on ransomware pressure against that identity core, especially domain controllers, where a single foothold can turn into broad compromise if internal paths remain open. The central governance issue is not just malware execution, but whether identity infrastructure is isolated enough to survive lateral movement.

Marks & Spencer and Change Healthcare are used as evidence that attackers increasingly aim for the systems that govern trust rather than the systems that merely hold data. That makes identity segmentation a containment problem, not just an access-control problem.

Key questions

Q: What breaks when attackers gain control of Active Directory during a ransomware attack?

A: If attackers control Active Directory, they can create new privileged accounts, push ransomware across endpoints and servers, and take over a large part of the environment. They may also use domain trust relationships and administrative tooling to expand access quickly. In practice, Active Directory compromise turns a local foothold into enterprise wide operational loss.

Q: Why do domain controller breaches make ransomware recovery so much worse?

A: Domain controllers are central trust brokers, so when attackers compromise them they can block access, manipulate authentication state, and force administrators into a much larger rebuild. The operational impact is longer downtime, more expensive recovery, and a higher chance that normal restore steps will simply reintroduce the compromise.

Q: What are the warning signs that ransomware is moving toward identity infrastructure?

A: Warning signs include unusual directory queries, unexpected trust checks, odd service enumeration, and connections from systems that normally do not touch the domain controller. These signals matter because attackers often map the environment quietly before privilege escalation. Teams should treat this combination as a movement pattern toward the identity core, not just routine noise.

Q: What should teams do immediately when a domain controller is exposed to lateral movement?

A: Teams should isolate the affected segment before the attacker can complete trust expansion. That means cutting unnecessary internal paths to identity services, validating which accounts and systems still need access, and preventing the compromise from spreading through the directory layer. The goal is to stop the attacker from turning one foothold into full compromise.

Technical breakdown

Why domain controllers become ransomware targets

Domain controllers sit at the center of Microsoft identity infrastructure. They enforce authentication, store account relationships, and issue trust decisions that other systems depend on. When attackers reach that layer, they no longer need to compromise every endpoint individually because the directory itself becomes a lever for broader access. In practical terms, the attacker is not just stealing data. They are taking control of the mechanism that decides whether systems and users are legitimate. That is why compromise of Active Directory creates such a disproportionate blast radius.

Practical implication: treat domain controllers as high-value assets that require segmentation, strict reachability limits, and separate monitoring.

How lateral movement turns a foothold into identity compromise

The article describes a common ransomware progression: initial access, internal reconnaissance, privilege escalation, and movement toward the domain controller. Once inside, attackers use ordinary-looking directory queries, trust checks, and service enumeration to map the path to the identity core. The technical problem is not only malware but east-west network openness that lets attackers keep moving after the first breach. If internal trust paths are flat, the attacker can discover and abuse the shortest route to identity control before defenders notice.

Practical implication: instrument internal paths, not just endpoints, so unusual account-to-system relationships and trust lookups become visible.

Why segmentation is the control that changes the outcome

Zero Trust segmentation changes the attack economics by removing unnecessary paths to identity services. Instead of assuming the domain controller can be reached from most of the environment, segmentation restricts which workloads, accounts, and networks can talk to it. That matters because ransomware operators need lateral reach as much as they need malware capability. When the identity core is isolated, a compromised workstation or server is less likely to become an enterprise-wide event. The article’s core point is that containment must start at the identity layer, not after the breach has already expanded.

Practical implication: segment identity infrastructure so only explicitly required systems can reach Active Directory services.

Threat narrative

Attacker objective: The objective was to control the identity core so a local breach could be expanded into broad enterprise compromise and operational disruption.

1. Entry occurred through an initial foothold in the environment, including a remote server without multi-factor authentication in the Change Healthcare case.
2. Attackers then performed internal reconnaissance and credential or privilege abuse to move toward the domain controller and identity infrastructure.
3. Privilege escalation and lateral movement let the attackers reach core identity systems, increasing their ability to control authentication and trust.
4. Impact followed in the form of enterprise disruption, data exposure, and ransomware-driven outages that extended beyond the original compromise.

Breaches seen in the wild

• Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.
• Cisco Active Directory credentials leak 2025: Kraken leaked Cisco Active Directory hashes, including service and krbtgt accounts; Cisco says they came from its 2022 breach, not a new one.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity infrastructure is now the primary ransomware containment boundary: When attackers target domain controllers, the issue is no longer just breach detection. The control plane for trust becomes the main asset under attack, which means traditional endpoint-centric containment arrives too late. Practitioners should treat identity reachability as a first-class security design problem.

Active Directory compromise is a blast-radius event, not a local incident: A domain controller holds account relationships, permissions, tickets, and trust dependencies that govern the rest of the environment. Once that layer is exposed, the attacker inherits the logic of the enterprise rather than a single system. The implication is that access architecture must assume directory compromise is catastrophic by design.

Standing east-west trust is the hidden failure mode: The article’s core pattern is not ransomware novelty, but open internal pathways that let attackers move from foothold to identity core. That makes flat network trust the structural weakness behind many modern ransomware outcomes. Security teams should stop measuring control effectiveness only at the perimeter and start measuring reachability to identity services.

Graph-based visibility is becoming mandatory for identity defense: The article correctly points to relationship mapping between accounts, workloads, and the domain controller. That is because lateral movement is a path problem, not just an alert problem. Practitioners need to understand which identities can traverse which trust edges before an attacker does.

Identity-layer containment should be treated as a Zero Trust outcome: Zero Trust is not complete when devices are monitored or users are authenticated. It is complete when the systems that issue trust, including Active Directory, are isolated from the movement patterns attackers exploit. That shifts the practitioner focus from detection alone to enforced containment around identity core services.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• Read next: Zero Trust Identity Guide

What this signals

Identity-core containment is now a ransomware design requirement: Security programmes that only harden endpoints will keep missing the path attackers actually want. The meaningful control point is the route into the directory layer, where trust is created and spread across the enterprise.

Directory reachability should be measured like an exposure surface: If too many systems can talk to the identity core, then the breach radius is already larger than most teams assume. Segmenting those routes changes whether a foothold becomes a recovery event or a full operational outage.

For practitioners

• Map every dependency on Active Directory Inventory which workloads, services, and administrative accounts depend on domain controller reachability so you can see where identity trust actually flows.
• Restrict east-west paths to identity services Allow only explicitly required systems to reach domain controllers and related identity services, and block broad internal reachability by default.
• Prioritise multi-factor authentication on remote access Remove unauthenticated remote entry points because a single remote foothold can become the starting point for lateral movement toward identity infrastructure.
• Use graph-based detection for identity movement Correlate account-to-system relationships, unusual directory lookups, and trust checks so anomalous paths toward the identity core stand out quickly.
• Test containment against a domain-controller attack path Run scenarios that assume attackers already have an internal foothold and validate whether segmentation prevents them from reaching the directory layer.

Key takeaways

• Ransomware increasingly succeeds by targeting the systems that govern identity trust, not just the devices where malware first lands.
• Marks & Spencer and Change Healthcare illustrate how a foothold can escalate into domain-controller access, outages, and broad enterprise disruption.
• Identity segmentation and restricted east-west reach to directory services are the controls most likely to stop a local compromise becoming a full compromise.

Key terms

• Domain Controller: A domain controller is the server that authenticates users, machines, and services in an Active Directory environment. Because it anchors the trust fabric, compromise of a controller can affect every domain-joined system and turn a single host flaw into an enterprise identity incident.
• Identity Core: The identity core is the set of systems and controls that decide who is trusted and what they can access, including Active Directory, domain controllers, and associated authentication services. If this layer is compromised, attackers inherit the mechanisms that govern the rest of the environment.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Zero Trust Micro-Segmentation: A Zero Trust approach that divides the environment into small policy zones so workloads, users, and endpoints only communicate when explicitly allowed. It shifts protection from the perimeter to the application and workload layer, where trust is continuously constrained by policy rather than assumed by network location.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.