Advanced Intrusion Campaign Leverages Sliver C2 and Custom Scripts to Disable Defenses and Steal Credentials
A sophisticated intrusion campaign targeting a US organization has been uncovered, utilizing the Sliver C2 framework and custom scripts to disable endpoint protection, steal credentials, and establish persistent access within a Windows domain.
A recent intrusion campaign has demonstrated how effectively attackers can compromise a Windows domain, transforming it into a launchpad for deeper malicious activities. The operators employed the Sliver command-and-control (C2) beacon, alongside custom scripts, to disable security measures, exfiltrate credentials through techniques like LSASS dumps and Mimikatz, and establish persistent access. The operation, tracked as UTA-2026-024 by The Hunter’s Ledger, targeted an unnamed US organization and originated from an exposed server.
Upon gaining initial access, the attackers scripted the creation of a new Active Directory account with a non-expiring password, immediately elevating it to Domain Admins. Further expanding their attack surface, they created a local administrator account, enabled Remote Desktop Protocol (RDP) access, and disabled Network Level Authentication (NLA). These actions significantly broadened the pathways available for lateral movement and subsequent exploitation within the compromised network.
A critical phase of the attack involved disabling the victim's endpoint protection. The attackers' scripts systematically stopped and disabled eight services associated with the deployed security product, meticulously verifying the status of each service. Concurrently, they targeted credential theft by collecting registry hives (SAM, SYSTEM, SECURITY) for offline password cracking, while also performing an LSASS memory dump and utilizing Mimikatz to extract credentials directly from memory.
The campaign's persistence mechanisms were particularly noteworthy. Attackers established persistence through scheduled tasks configured to run as SYSTEM, employing forged author details and backdated registration dates to evade detection. One weekly task was designed to download the latest attack chain without saving a fixed payload, a tactic reminiscent of remote scheduled task delivery observed in EtherRAT attacks. Additionally, the attackers manipulated the victim's DNS content filter, adding their own domain to an allowlist and creating a corresponding record in the internal DNS, effectively bypassing security controls intended to block it.
Adding another layer of sophistication, the toolkit incorporated a Node.js implant that fetched its C2 server information from an Ethereum smart contract. The initial domain recorded in this contract directly correlated with the domain added to the victim's DNS configuration, linking the blockchain-based C2 infrastructure to the network compromise. This smart contract rotated domains five times over five months, presenting a challenge for static domain blocking, yet the contract itself remained a publicly accessible tracking point for defenders.
While the recovered materials did not contain evidence of ransomware deployment in this specific incident, the operation's infrastructure has been linked to a confirmed ransomware incident. The Hunter's Ledger noted that the attackers combined readily available public tools with an unusually detailed understanding of the victim's network, creating a robust post-exploitation toolkit. This approach highlights a growing trend where attackers leverage legitimate administrative features and common tools in novel ways to achieve their objectives.
Recommended response measures include resetting all domain credentials, thoroughly reviewing privileged group memberships and scheduled tasks, restoring DNS configurations, rotating filter administrator passwords, and removing any planted internal DNS entries. Security teams are advised to monitor for RDP enabled without NLA and watch the Ethereum contract for future C2 changes. Proactive defense should focus on behavioral analysis rather than solely relying on signatures for common tools, with particular attention paid to fileless download commands running as SYSTEM and sudden changes in endpoint protection services.
The tactics employed in UTA-2026-024, such as disabling endpoint protection and using sophisticated C2 infrastructure, are indicative of advanced persistent threats. This incident serves as a stark reminder of the evolving threat landscape and the need for continuous vigilance and adaptation in cybersecurity defenses, especially against actors who demonstrate a deep understanding of Windows environments and readily available exploitation tools.