Attackers Disrupted Windows Domain Operations
The incident involved the unauthorized use of Active Directory Group Policy to bypass standard security measures.
Updated on Sept. 21, 2026 in Cybersecurity
Live Poll
Should organizations implement stricter controls over administrative access to prevent unauthorized network disruptions?
During April 2026, attackers gained domain-admin-equivalent rights to disrupt Windows domain operations. They achieved this by accessing a FortiGate SSL VPN using compromised domain credentials.
Why it matters
This incident highlights a significant security vulnerability where legitimate administrative tools like Group Policy are weaponized for disruption rather than traditional malware. The absence of endpoint malware underscores a shift toward living-off-the-land techniques that evade standard detection methods.
The attackers utilized Active Directory Group Policy to perform the disruption without deploying any Windows encryptors or running malware on endpoints.
The players
Kaspersky GERT
This is a specialized incident response team that provides forensic analysis and remediation support for complex cyberattacks.
The details
The attackers successfully accessed a FortiGate SSL VPN by leveraging compromised domain credentials. By obtaining domain-admin-equivalent rights, they were able to disrupt Windows domain operations directly through the native group policy management infrastructure.
Timeline
The attackers gained unauthorized access to the FortiGate SSL VPN in April 2026.
Kaspersky GERT initiated a formal response to the incident on April 13, 2026.
The Tech Race
This attack reflects a shift toward living-off-the-land techniques where intruders exploit native systems like Active Directory Group Policy rather than relying on external malicious software. By mimicking legitimate administrative actions, attackers successfully bypass traditional security layers that monitor for unauthorized code execution.
Users and administrators must prioritize robust credential management, such as multi-factor authentication, to protect sensitive VPN entry points. Because the attack utilized legitimate administrative tools, standard antivirus software may fail to flag the malicious activity, requiring deeper behavioral monitoring.
The takeaway
Security teams should implement strict least-privilege models for administrative tools to prevent the abuse of internal policies. Monitoring for anomalous Group Policy changes is essential for identifying potential intrusions early.
Further reading
For more information on evolving digital threats, visit the Cybersecurity section.
Live Poll
Should organizations implement stricter controls over administrative access to prevent unauthorized network disruptions?
