IcedID Malware Strikes Again: Active Directory Domain Compromised in Under 24 Hours

A recent IcedID malware attack enabled the threat actor to compromise the Active Directory domain of an unnamed target less than 24 hours after gaining initial access.
"Throughout the attack, the attacker followed a routine of recon commands, credential theft, lateral movement by abusing Windows protocols, and executing Cobalt Strike on the newly compromised host," Cybereason researchers said in

abusing access active directory actor attack cobalt cobalt strike compromise compromised credential credential theft cybereason directory domain host icedid initial access lateral movement malware malware attack protocols recon researchers strike target theft threat threat actor under windows