Hackers Disable Endpoint Protection

Overview

A new intrusion campaign demonstrates how quickly attackers can transform a Windows domain into a launchpad for deeper compromise. Using the Sliver command‑and‑control beacon, credential theft, and remote administration, operators staged a coordinated attack across an Active Directory environment, tracked as UTA‑2026‑024 by The Hunter’s Ledger.

Attack Chain

• Domain account creation: Attackers scripted a non‑expiring password account and added it to Domain Admins.
• Local administrator setup: Enabled RDP access and disabled Network Level Authentication.
• Endpoint protection disabled: Eight security services were stopped and disabled, with checks confirming service states.
• Credential theft: SAM, SYSTEM, and SECURITY hives collected for offline cracking; LSASS dump and Mimikatz used for additional credentials.
• Persistence: SYSTEM‑level scheduled tasks with forged author details and backdated registration dates.

Advanced Techniques

• Fileless PowerShell tasks: Weekly scheduled tasks downloaded payloads dynamically, echoing tactics seen in EtherRAT campaigns.
• DNS manipulation: Attackers altered DNS content filters, allowlisting their domain and inserting internal records to bypass security controls.
• Blockchain C2: A Node.js implant resolved its command server via an Ethereum smart contract, complicating domain blocking.

Indicators of Compromise (IoCs)

• IP addresses: 193.233.202.17 (primary C2), 77.110.126.46 (fallback), 146.103.127.44 (historical).
• Domains: publisherresolution.com, resumeacceptable.com, simultaneouslypower.com, wiselystarting.com, itemrange.com.
• Files: svcload.exe (PrintSpoofer derivative), ws35.exe/ws36.exe/ws37.exe/ws_3srv.exe (reverse shells), task_39.ps1 (PowerShell payload), slv_beacon_sc.bin (Sliver beacon).
• Smart contract: 0xb3f2897f2bc797e5b9033faef8c81e92b01cb831.
• User‑Agent: Chrome/108.0.6602.492 (malformed, hardcoded).

Defensive Guidance

Organizations should:

• Reset credentials across the domain, not just known accounts.
• Review privileged groups and SYSTEM tasks for unauthorized entries.
• Restore DNS filters and rotate administrator passwords.
• Monitor RDP for sessions with Network Level Authentication disabled.
• Baseline scheduled tasks and alert on fileless SYSTEM downloads.
• Track blockchain contracts for evolving C2 domains.
• Watch endpoint protection for sudden service stops or disablement.

Expert in the Cloud Insight

This campaign highlights how attackers weaponize trusted administrative features once inside a domain. By chaining Sliver beacons, credential theft, and blockchain‑based C2, they create durable access packages that evade traditional defenses. The lesson is clear: defenders must focus on behavior—unexpected SYSTEM tasks, DNS manipulation, and endpoint protection changes—rather than relying solely on static signatures.