Topic starter
11/07/2026 8:29 pm
TL;DR: Ransomware crews are increasingly targeting Active Directory and domain controllers because compromise of the identity core turns a local foothold into broad enterprise control, as illustrated by Marks & Spencer and Change Healthcare, according to Illumio. Identity-layer containment, not just endpoint defense, now defines whether lateral movement becomes full compromise.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “Beyond the Gate: Zero Trust and the Defense of Active Directory”.
Key questions
Q: What breaks when attackers gain control of Active Directory during a ransomware attack?
A: If attackers control Active Directory, they can create new privileged accounts, push ransomware across endpoints and servers, and take over a large part of the environment.
Q: Why do domain controller breaches make ransomware recovery so much worse?
A: Domain controllers are central trust brokers, so when attackers compromise them they can block access, manipulate authentication state, and force administrators into a much larger rebuild.
Q: What are the warning signs that ransomware is moving toward identity infrastructure?
A: Warning signs include unusual directory queries, unexpected trust checks, odd service enumeration, and connections from systems that normally do not touch the domain controller.
Practitioner guidance
- Map every dependency on Active Directory Inventory which workloads, services, and administrative accounts depend on domain controller reachability so you can see where identity trust actually flows.
- Restrict east-west paths to identity services Allow only explicitly required systems to reach domain controllers and related identity services, and block broad internal reachability by default.
- Prioritise multi-factor authentication on remote access Remove unauthenticated remote entry points because a single remote foothold can become the starting point for lateral movement toward identity infrastructure.
Bottom line: Ransomware increasingly succeeds by targeting the systems that govern identity trust, not just the devices where malware first lands.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:58 pm
Identity infrastructure is now the primary ransomware containment boundary: When attackers target domain controllers, the issue is no longer just breach detection. The control plane for trust becomes the main asset under attack, which means traditional endpoint-centric containment arrives too late. Practitioners should treat identity reachability as a first-class security design problem.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do immediately when a domain controller is exposed to lateral movement?
A: Teams should isolate the affected segment before the attacker can complete trust expansion. That means cutting unnecessary internal paths to identity services, validating which accounts and systems still need access, and preventing the compromise from spreading through the directory layer. The goal is to stop the attacker from turning one foothold into full compromise.
👉 Read our full editorial: Ransomware containment depends on defending the identity core