Why do attackers target Active Directory first?

High-value ransom theft: Aiming for large-scale information theft from file servers and the shutdown of core systems, seizing administrator privileges of Active Directory that can take over the network.

Active Directory is a convenient system for users and administrators as an authentication infrastructure for authentication and authorization. At the same time, it is also a system that is advantageous for ransomware attackers. By taking over Active Directory, attackers can change user account passwords or create new accounts, allowing them to access the entire system. Once compromised, they can use the organization's management information and user account modification privileges to carry out cross-cutting attacks such as service disruption or interference. As a result, the entire organization can suffer serious impacts on its operations. This document explains the attackers' objectives, the flow of attacks, and at which stages it is possible to prevent damage.

Other security