BlackMatter’s reach was set by the directory, not the malware

The week

On October 18, 2021, CISA, the FBI and the NSA issued a joint cybersecurity advisory on BlackMatter, numbered AA21-291A. CISA is the federal agency responsible for helping protect US civilian networks and critical infrastructure. BlackMatter was a ransomware-as-a-service operation first seen in July 2021. Ransomware is malicious software that scrambles an organization’s files and demands payment to unlock them. “As-a-service” means the developers rented their tools to affiliates, other criminals who carried out the attacks and shared the proceeds.

The advisory described BlackMatter as a possible rebrand of DarkSide, an operation active from about September 2020 to May 2021. DarkSide’s ransomware was behind the May 2021 attack on Colonial Pipeline, which halted the largest fuel pipeline serving the US East Coast for several days. DarkSide announced it was closing soon afterward. BlackMatter appeared roughly two months later.

Since July, BlackMatter had targeted multiple US critical infrastructure organizations, including two in the food and agriculture sector. The advisory did not name them. Press reports in September had linked the group to an attack on NEW Cooperative, an Iowa farm cooperative, during the autumn harvest. The ransom demands the agencies described ranged from $80,000 to $15 million, payable in Bitcoin or Monero.

The advisory’s most telling detail was that BlackMatter samples carried embedded, previously compromised credentials. The malicious program arrived with real usernames and passwords already built in, stolen from the victim before the attack began. The agencies also described the actors harvesting further credentials from the memory of LSASS, the Windows process that handles sign-ins.

From there, the attackers used two everyday Windows technologies. LDAP is the method computers use to look things up in Active Directory, the central directory most organizations use to manage users, computers and permissions. SMB is the method Windows computers use to share files and folders across a network. Using these, the attackers discovered hosts in Active Directory and listed the shared folders on each one, including the hidden administrative shares Windows creates by default. They then encrypted those hosts and shares remotely.

Three further details mattered for defenders. A separate encryption program targeted Linux systems and routinely encrypted VMware ESXi virtual machines, the platform beneath many virtual servers. Rather than encrypting backups, the actors wiped or reformatted backup data stores and appliances. And they tried to take copies of data first, to add the threat of publication.

The recommended mitigations were familiar: strong and unique passwords, including for service and domain administrator accounts; multifactor authentication, especially for webmail and VPNs; patching; and removing unnecessary access to administrative shares. The agencies also listed segmentation, time-based access for privileged accounts, limits on command-line and scripting tools, and encrypted, immutable, offline backups. Detection signatures for the open-source Snort network monitor were included too.

The advisory landed in a busy month. The White House had just convened officials from more than 30 countries to discuss ransomware. Within days of the advisory, Reuters reported that a multi-country operation had pushed the REvil ransomware group offline. Around October 24, the security firm Emsisoft disclosed that it had been privately helping BlackMatter victims recover files since the summer, using a flaw in the group’s encryption. In early November, BlackMatter told affiliates it was shutting down, citing pressure from authorities, and existing victims were steered to LockBit’s negotiation sites. Shutdowns like that often precede a rebrand.

Ransomware advisories are usually read for their indicators: hashes, domains, tool names. These are the technical fingerprints that security teams load into their tools to spot a known threat. The BlackMatter advisory was more useful read for its method. The attackers did not need a novel exploit, a clever trick to break into software. They arrived holding valid credentials, asked the directory what existed, and used ordinary Windows administration to reach it.

That shifts the question a bank, health system or agency should ask. Detecting BlackMatter by name matters less than knowing how far an attacker holding one privileged credential could go. Security people call that distance the blast radius.

The analysis below has three core parts, one for each decision that set BlackMatter’s blast radius: how the credential was obtained, how the directory extended its reach, and which controls set the limit. Before them comes a short explanation of the moving parts. After them come the same intrusion told step by step and what one shared login costs in money and obligations. The piece closes with a list of controls, the ways organizations undercut them, and the questions a leader can ask.

The argument throughout is narrow and, we think, still underappreciated. The malware decided very little. The access design an organization had built over years decided almost everything.

Credentials, directories and shared drives

Credentials. A credential is whatever proves who you are to a computer: usually a username and password, sometimes combined with a code from a phone or a physical key. A privileged credential is one with administrative powers, the ability to install software, change settings or reach systems that ordinary users cannot.

Service accounts. Some accounts belong to software rather than people. A backup tool, a monitoring system or a payroll interface signs in to other systems under its own account. These accounts often hold broad rights, because the software needs to reach many machines, and their passwords are often set once and never changed.

Active Directory. Most medium and large organizations run their Windows networks on Active Directory, Microsoft’s directory service. It lists every user, every computer and every shared folder, and it records who is allowed into what. When an employee logs in in the morning, Active Directory checks their password and decides what they can open. A domain is the territory Active Directory manages, and a domain administrator is, in effect, the holder of the master key.

Domain controllers. These are the servers that run Active Directory itself. Whoever controls a domain controller can create accounts, change passwords and grant any right to anyone. Security teams call these systems, and anything that can control them, “Tier 0.”

LDAP and SMB. LDAP is the language computers use to ask the directory questions, such as “list all the servers” or “who belongs to the finance group.” SMB is the method Windows uses to share files and folders, the reason staff can open a shared drive from their desk. Both are completely normal. Every working Windows network uses them all day.

Administrative shares. Windows creates hidden shared folders on most machines by default, with names such as ADMIN$ and C$. They let administrators reach a machine’s disk and system folders across the network. They are convenient for support staff, and for anyone else holding an administrator’s credential.

Virtualization. Many organizations no longer run one physical machine for each server. Instead, a single powerful computer, called a hypervisor or virtualization host, runs many virtual servers at once, each behaving as if it were a separate machine. VMware ESXi was, and remains, among the most widely used. Hosts are usually managed together through a central console. It is efficient. But whoever controls the host controls every virtual server on it.

Ransomware-as-a-service. BlackMatter’s developers rented their software to affiliates. That matters because the same tools turn up in many different attacks, run by different people with different skills. It also means a group can close down and reappear under a new name with the same people behind it.

One consequence of the affiliate model is easy to miss. The developers wrote the encryption program, but the affiliates chose the victims and did the break-in. Two BlackMatter incidents could look very different in their early stages. What they shared was the end state, and that end state depended on what the victim’s own directory allowed.

How the credential was obtained

The advisory said the ransomware binaries, the actual program files, carried credentials that had been compromised before deployment. That detail places the decisive failure earlier than the encryption. Someone stole or bought a working account, and the ransomware was the last step of a longer intrusion.

Embedding the credential also tells defenders something about timing. The affiliate had to hold a working login long enough to build a custom copy of the ransomware around it. That implies days or weeks of access before anything was encrypted, and a window in which the intrusion could have been found.

Where stolen logins come from

The usual sources are familiar. Phishing, emails that trick staff into typing their password into a fake page. Reuse of passwords leaked in unrelated breaches, where an employee’s password for a shopping site turns out to match their work password. Exposed remote desktop and VPN services, the doors that let staff work from home, left reachable from the internet with weak protection. And infostealer malware on personal or unmanaged devices that also hold work sessions: software that harvests saved passwords from a home laptop that an employee also uses to check work email.

Stolen logins are also traded. Criminal brokers sell remote access to compromised organizations, sorted by sector and size, to whoever will pay. For a ransomware affiliate, buying an entry point is often cheaper than finding one. The organization whose password was stolen may never connect the two events, because the theft and the attack can be months apart and carried out by different people.

Once inside, the attacker usually looks for better credentials. The advisory described BlackMatter actors harvesting them from LSASS memory. When an administrator signs in to a machine, Windows can keep material in memory that lets that session reach other systems. An attacker with control of that machine can lift it. So every machine a domain administrator has touched becomes a place where the master key can be copied.

Which defenses work at this stage

Defense at this stage is identity hygiene. Multifactor authentication on remote access and on every administrative account cuts the value of a stolen password, because the attacker also needs the second factor. Monitoring for sign-ins from new locations, impossible travel (a login from two distant countries within an hour) or unusual hours catches part of what remains.

Not all second factors are equal. A code sent by text message or a push notification approved on a phone can be phished or worn down by repeated prompts. Hardware security keys and similar methods bound to the real website resist that. Most organizations in 2021 could not move everyone to the strongest method quickly. They could start with administrators and remote access, where a stolen credential does the most damage.

Credential hardening also belongs here. The advisory suggested stopping Windows from keeping clear-text passwords in memory, limiting older authentication methods such as NTLM and WDigest, and turning on Credential Guard, a Windows feature that isolates sign-in secrets. Unique local administrator passwords on each machine, which Microsoft’s free LAPS tool already offered, stop one cracked laptop from unlocking every other laptop.

Accounts nobody owns

The most neglected task is retiring accounts. Service accounts created for a project years ago often hold broad rights, passwords that never change and no named owner. They are ideal for an attacker and rarely watched, so a quarterly review that disables any privileged account without an owner removes credentials worth stealing.

The review is harder than it sounds. Disabling an unowned service account can break an overnight batch job that nobody remembers depends on it. Teams that succeed usually disable first, wait, and delete later, keeping a short rollback path. They also record a business owner, a technical owner and a purpose for every account that survives. That record is what an examiner or auditor will ask for.

How the starting point differs by organization

The source of the first credential differs by sector. A credit union or community bank often relies on a core processor and a managed service provider, so third-party technicians with remote access are a common route in. Under the federal banking agencies and the NCUA, that access is still the institution’s responsibility. The FFIEC’s August 2021 authentication guidance had just reminded institutions that access controls apply to employees, third parties and system accounts as well as customers.

A broker-dealer or wealth manager usually has a smaller estate but many remote and independent representatives, each with their own devices. A health system has shared clinical workstations, badge-tap sign-ins and thousands of clinicians who move between sites. Their sessions are hard to bind to a second factor without slowing patient care.

A county government may share one directory across the clerk, the courts and the sheriff. The sheriff’s access to criminal justice information falls under the FBI’s CJIS Security Policy, which sets its own authentication requirements. The county’s other departments often run at a lower standard on the same directory. Federal civilian agencies were working under Executive Order 14028, signed in May 2021, which gave them 180 days to adopt multifactor authentication and encryption. That deadline fell in early November 2021, weeks after the advisory.

How the directory extended its reach

Once inside, BlackMatter queried Active Directory over LDAP and reached the hosts and shares it found over SMB. The advisory said the actors listed the shares on each host and encrypted them remotely, including administrative shares and the folders domain controllers use to distribute policies and sign-in scripts. These are ordinary administration tools; they are how Windows networks function.

What any user can read

Any authenticated user can read much of a typical directory, including the list of servers, file shares and members of administrative groups. That openness is by design. Software and staff need to look things up, and Active Directory dates from a time when the internal network was assumed to be friendly.

Attackers turned that openness into a map. Free tools, of which the open-source BloodHound is the best known, read the directory and draw every path from an ordinary account to a domain administrator. A path might run through a forgotten group membership, a helpdesk account allowed to reset passwords, or a server where an administrator once signed in. Defenders can run the same tools. Many did not, and attackers frequently understood a victim’s directory better than its owners did.

Why tiering limits the radius

An account with domain-wide administrative rights can act on almost everything it finds. This is why the directory sets the blast radius. Where a handful of administrative accounts can log on to every server, every workstation and every share, compromising one of them compromises the estate.

Where administration is divided into tiers, the same compromise reaches far less. In Microsoft’s tier model, which it later reframed as an enterprise access model, the accounts that manage domain controllers never sign in to ordinary servers or desktops. Server administrators never sign in to desktops. Their credentials are therefore never left in memory on the machines most likely to be compromised. The malware is identical in both cases. The outcome is set by design choices made long before.

In one office building, every manager carries a master key that opens every door, including the room where the master keys are cut. In another, floor managers have keys for their floors, and only two people, who never carry them outside a locked room, hold keys to the key room. A pickpocket who lifts one manager’s keys in the first building owns the building. In the second, they get one floor.

What the lookup leaves behind

The same use of the directory also leaves traces. A workstation account that suddenly queries every computer object, or a single host that opens SMB sessions to hundreds of servers in an hour, is behaving unlike any normal user. Directory services and endpoint tools, the security software on individual computers, can record both.

Few organizations alert on them, partly because legitimate inventory and backup tools generate similar noise. Building a short allow-list of the systems that are supposed to enumerate the directory, and alerting on everything else, turns the attacker’s reconnaissance into an early warning rather than a footnote in the post-incident report. The Snort signatures in the advisory worked at the other end of the attack. They caught the ransom note being written to shares, which helps stop the spread but arrives after encryption has begun.

The platform beneath the servers

Virtualization widened the radius. Encrypting one hypervisor takes down every virtual machine it hosts at once, including some that were never joined to the domain. The security software that protects each Windows server runs inside the virtual machine, so it cannot see an attack on the host beneath it.

Hypervisor management consoles are often tied to the same directory for convenience. That means a domain administrator credential may reach the platform beneath the servers, and the backup servers, too. The advisory’s note that BlackMatter wiped backup stores and appliances matters here. An attacker who can sign in to the backup console with a directory credential does not need to break the backups. They can delete them through the normal interface.

Health systems and agencies that consolidated onto a few large clusters gained efficiency and, without separate administration, a bigger single target. Banks, which tend to run more mature privileged access programs, often still leave service accounts and legacy integrations outside them. Smaller institutions that outsource infrastructure face a variant of the same problem: the provider’s administrators may hold one set of credentials that reaches many clients.

Which controls set the limit

The advisory’s mitigations map onto this picture. Each one cuts a specific step in the path from one stolen credential to an encrypted estate. Read that way, the list stops looking generic.

Time-bound privilege

Time-based access for privileged accounts means administrative rights are granted only for a set window when needed, so a credential stolen on Tuesday may not work on Wednesday. The advisory went further than most guidance. It suggested keeping administrator accounts disabled in the directory by default and enabling them only for a set time, partly because attacks so often begin outside business hours.

The operational cost is real. Someone has to approve each window, emergencies need a break-glass path that works at 3 a.m., and every exception must be logged. Organizations with a privileged access management product can automate most of this. Smaller ones can approximate it with disabled accounts, a ticket and a second person who enables them.

Containing SMB and administrative shares

Segmentation, dividing the network into zones with controlled connections between them, decides which hosts can open SMB connections to which, so one compromised machine cannot address every share. The advisory gave a precise version: remove unnecessary access to administrative shares, and use host-based firewalls so those shares accept connections only from a small set of administrator machines.

That control is cheap, it is mostly configuration, and it directly blocks the technique BlackMatter used to encrypt remotely. Its cost is discovery work. Teams have to learn which tools depend on administrative shares, such as software deployment, monitoring and some backup agents, and route them through approved hosts.

Scripting and remote execution

Restricting PowerShell, a powerful built-in Windows scripting tool, and remote execution to the administrators and jump hosts that need them removes the easiest way to push encryption across a network. A jump host is a tightly controlled machine that administrators must pass through to do privileged work. Blocking scripting outright breaks legitimate automation, so most organizations restrict who can run it and log what it does.

Backups the directory cannot reach

Backups stored offline or on immutable storage, storage that cannot be altered or deleted for a set period, under credentials that do not exist in the production directory, keep recovery out of reach. Given BlackMatter’s habit of wiping backup appliances, the credential separation matters as much as the media. A backup system administered with domain credentials is part of the blast radius, however good its storage.

Testing completes the control. A restore exercise should rebuild a domain controller and a core application from backup, measure the time taken, and record what failed. Many organizations discovered during real incidents that restoring hundreds of servers at once took weeks, because the restore process had only ever been tested on single files.

Cost, sequence and measurement

These controls are configuration and operating discipline rather than product purchases, and they compete with daily work for attention. Tiering also has real costs. Administrators need separate accounts and often separate workstations, and some vendor tools assume domain-wide rights and must be reconfigured or replaced. Organizations that tried to tier everything at once often stalled. Those that started with the domain controllers, hypervisor management and backup systems, the assets whose compromise ends the game, made faster progress.

A useful exercise is to pick the most privileged account in the environment and trace it on paper. List everything it can reach, every system where it has signed in, and every place its credentials could be harvested. That map is the blast radius. Measuring it before and after each control is a better progress metric than counting tools deployed.

A second metric is the number of accounts with domain administrator or equivalent rights, which in many organizations runs into dozens when a handful would do. A third is the share of privileged sign-ins that come from approved administrative workstations. All three can be reported quarterly to a risk committee without technical translation.

Evidence an examiner or auditor would ask for

The same controls produce records that answer most outside questions. A current list of privileged accounts, each with an owner and a purpose, shows account governance. Approval logs for time-bound access show that privilege is granted deliberately. Firewall rules for administrative shares, and the list of hosts allowed through them, show segmentation in a form an auditor can test.

Restore test reports, with dates, scope and elapsed time, show that backups are more than a policy. For organizations that outsource infrastructure, the contract should say which provider staff hold privileged access, how it is approved and how quickly it is revoked. Bank examiners, HIPAA auditors and state auditors phrase their questions differently, but they tend to ask for these same artifacts.

The case against, and why it still holds

The strongest objection is that detection has improved. Endpoint detection and response tools, which watch for malicious behavior on each machine, catch many intrusions before encryption. On that view, investment in tiering yields less than investment in monitoring. The objection has force, and good detection is worth having.

It still leaves two gaps. Detection depends on someone responding in time, and attacks are timed for nights and weekends. And the platforms that matter most here, hypervisors and backup appliances, often cannot run endpoint agents at all. Access design limits the damage even when detection fails, which is the case that matters.

A second objection is that the directory is on its way out, replaced by cloud identity. For many organizations in 2021, and many still, cloud identity was synchronized from the on-premises directory. A compromised domain could then reach the cloud tenant too. Moving identity to the cloud changes where the directory lives. It does not remove the need to limit what one account can reach.

How an intrusion like this unfolds, step by step

Each step in the sequence is a point where an organization can either stop the attacker or let them through. The outline below is general; it follows the pattern the advisory describes rather than any single victim.

Step one: the stolen key. An attacker obtains a working username and password, through phishing, a leaked password, a purchase from an access broker or malware on a home device. If the account has multifactor authentication, the password alone is not enough, and the attack often stalls here.

Step two: the ordinary-looking entry. The attacker signs in through a remote access service, looking like an ordinary employee working from home. Monitoring that flags a sign-in from an unusual location or at an unusual hour is the second chance to notice. Some attackers then install legitimate remote support software, which the advisory noted BlackMatter actors abused, so they keep access even if the password is changed.

Step three: the directory lookup. The attacker asks Active Directory for a list of servers, shares and administrative groups. To the network, this looks like routine housekeeping. Only an organization that knows which systems normally do this, and alerts on others, will see it for what it is.

Step four: climbing the ladder. If the stolen account is not already powerful, the attacker looks for a way to get a more powerful one, for example by finding an administrator’s credentials stored on a machine they can reach. Tiering makes this much harder, because powerful credentials are never left lying on ordinary machines.

Step five: taking copies. Before encrypting, many attackers copy sensitive data out of the network, so they can threaten publication if the victim restores from backup. Large outbound transfers to unfamiliar cloud storage are visible to anyone watching egress traffic. This step turns an outage into a possible data breach, with the notification duties that follow.

Step six: reaching the crown jewels. With administrative rights, the attacker looks for the virtualization platform and the backups. If those share the same directory and the same logins, they are within reach. If they are run on separate credentials, the attacker hits a wall.

Step seven: the encryption. Only at the very end does the ransomware run, scrambling servers and shared drives across the network, often at night or over a weekend when fewer people are watching. Backups are wiped first where they can be reached.

Read this way, the encryption is the least interesting step. Every earlier step is an ordinary security or access decision. An organization does not need to win all of them, but each one it wins shrinks what the attacker can reach at the end.

The sequence also suggests where to spend. Steps one and two are where most organizations already invest. Steps three, four and six are where design matters most and spending is often thinnest. Step five depends on egress monitoring that many mid-sized organizations lack.

What one shared login costs

Consider a hypothetical mid-sized food distributor. Its IT team is small and stretched. Years ago, to save time, it gave its backup software and its virtualization console the same administrator login as everything else. An attacker steals that login through a phished VPN password. Over a weekend, the attacker lists every server, encrypts the virtualization hosts, which takes down dozens of virtual servers at once, and deletes the backups using the same credential. On Monday, trucks cannot be scheduled and orders cannot be filled. The company’s choice is now between a long, expensive rebuild and a ransom payment, with all the legal and ethical complications that brings.

Nothing in that story required brilliant hacking. Every step used legitimate access that the company had granted itself for convenience. Identity design is therefore a decision for senior leadership, as much as an IT preference.

Money. The difference between losing one department and losing the whole estate is the difference between a bad week and an existential event. Recovery time drives revenue loss, overtime and contractual penalties. Rebuilding a directory after a full compromise is slow, because every account, server and trust relationship must be treated as suspect.

Customers and the public. The advisory named critical infrastructure, including food and agriculture. When those organizations stop, the effect reaches shelves, patients and citizens.

Regulators. The obligations differ by type of organization. National banks, state member banks and state nonmember banks became subject to the federal banking agencies’ computer-security incident notification rule, finalized in November 2021. It requires notice to the primary regulator within 36 hours of determining that a significant incident has occurred. Credit unions report to the NCUA, which adopted its own 72-hour rule in 2023.

A health system faces HIPAA. HHS guidance from 2016 treats ransomware encryption of protected health information as a presumed breach unless the organization can show a low probability of compromise. That turns a technical question about the blast radius into a notification question. The fewer systems an attacker reaches, the narrower that analysis becomes.

A public agency faces state breach laws, public records demands and, for law enforcement systems, CJIS obligations. A broker-dealer’s obligations run through the SEC and FINRA, including Regulation S-P for customer records. Organizations should check with counsel on which regime applies to each entity, since many groups contain more than one.

Insurers. Questions about multifactor authentication, privileged access and offline backups appeared with growing frequency on cyber insurance applications around this time. Answering them honestly requires knowing the blast radius, and an inaccurate answer can complicate a claim.

Staff. Tiering asks administrators to work differently, with extra accounts and extra steps. Leaders who explain why, and fund the work, get adoption. Those who mandate it without support get workarounds, such as a shared spreadsheet of passwords, that recreate the problem.

Downstream partners. A compromised directory can also reach outward. Trusts between domains, partner VPNs and vendor accounts may give an attacker a path into another organization. Banks with correspondent relationships, health systems sharing records with affiliated practices and counties linked to state networks each carry some of their partners’ blast radius as well as their own.

Shrinking the blast radius

The controls that shrink it, roughly in the order that gives the most protection for the effort:

• Multifactor authentication on all remote access and on every administrative account, with phishing-resistant methods for administrators first.
• Separate administration for domain controllers, hypervisor management and backup systems, with credentials that do not exist in the production directory.
• A small, known number of domain-wide administrator accounts, used only from dedicated, protected machines.
• Administrative shares closed or limited by host firewall to a few administrator machines.
• Unique local administrator passwords on every machine.
• Privileged rights granted for limited time windows rather than permanently.
• Alerts when an unexpected machine lists the whole directory or connects to hundreds of servers.
• Backups that are offline or immutable, and tested by actually restoring from them at scale.
• A quarterly review that disables privileged and service accounts with no named owner.

The ways organizations undercut them:

• Tying backup and virtualization consoles to the main directory “for convenience.”
• Letting old service accounts keep broad rights and never-changing passwords.
• Granting a managed service provider standing domain administrator rights across all systems.
• Trying to redesign all administration at once, stalling, and doing nothing.
• Measuring security by the number of tools bought rather than by how far one stolen login can travel.
• Treating ransomware as a malware problem to be solved by detection alone, when the damage is set by access design.

The list is short on purpose. A mid-sized organization can complete the first three items on its most critical systems within a quarter or two, with existing staff and few purchases. The rest follow as the program matures. What matters is that the most powerful credentials are separated first.

How far one stolen login could go

• If an attacker stole the login of our most powerful administrator account today, what could they reach? Can you show me on one page?
• How many accounts have domain-wide administrator rights, and what is our target number?
• Could the same stolen credential reach our backups and our virtualization platform?
• Which service accounts have broad rights but no named owner, and when did we last review them?
• When did we last restore critical systems from backup in a test, and how long did it take?

A good answer to the first item is a diagram, not a reassurance. It should show the account, the systems it can reach, and the controls that stop it at each boundary. If nobody can draw it, that gap is the first finding.

BlackMatter itself came and went in a few months. The question it raised, how far one stolen key can open doors in your organization, remains the right one to ask.

With hindsight

BlackMatter itself was short-lived, but its method outlasted it. In an April 2022 flash report, the FBI said many developers and money launderers for ALPHV, also known as BlackCat, were linked to DarkSide and BlackMatter. That is the rebrand pattern in action: the name changes, the people and techniques carry on.

ALPHV became one of the most active ransomware operations of the following two years. In December 2023, the Justice Department announced that the FBI had disrupted it and built a decryption tool offered to more than 500 victims. The group kept operating regardless.

ALPHV claimed the February 2024 attack on Change Healthcare that disrupted claims and pharmacy processing across the US health system. In written testimony to Congress in May 2024, UnitedHealth Group’s chief executive said the attackers had used compromised credentials to sign in to a remote access portal that lacked multifactor authentication. Ransomware was deployed nine days later. That is the BlackMatter sequence almost exactly: a stolen login, days inside, then encryption.

For many executives, Change Healthcare was the moment ransomware stopped feeling like someone else’s problem. It showed how a single compromised organization in the middle of an industry can stall payments and prescriptions far beyond its own walls. Blast radius, in that case, was measured across a sector.

Stolen credentials remained the dominant entry point in other high-profile cases. In mid-2024, Mandiant reported that a campaign against customers of the Snowflake data platform used credentials stolen by infostealer malware, often from contractor or personal devices, against accounts without multifactor authentication. Some of the credentials were years old and still valid. Account retirement and multifactor coverage, unglamorous in 2021, were the controls that would have stopped it.

Encryption of virtualization hosts became a common feature of major ransomware families. In February 2023, the ESXiArgs campaign encrypted large numbers of unpatched, internet-exposed ESXi servers, and CISA published a recovery script. The risk the advisory pointed to, where one master system controls many servers, turned out to be exactly what attackers went after.

Attackers also found new ways to get the first credential. Social engineering of IT help desks to reset privileged accounts, the hallmark of groups such as Scattered Spider in a November 2023 CISA and FBI advisory, became a prominent route into large environments. Instead of stealing a password, the attacker phones the help desk, impersonates an employee and asks for a reset.

In July 2025, Google’s threat intelligence group described Scattered Spider moving from a reset Active Directory account to the VMware management console and then to the ESXi hosts. The group deployed ransomware from the hypervisor in a matter of hours. Its advice centered on phishing-resistant authentication and on isolating domain controllers, backups and privileged access tools from the infrastructure they protect. That is the tiering argument of 2021, restated four years later.

Policy moved in the same direction. The White House’s January 2022 zero trust memorandum, M-22-09, required federal agencies to use phishing-resistant multifactor authentication for their staff. Microsoft built its local administrator password tool into Windows in 2023. HHS proposed, in early 2025, an update to the HIPAA Security Rule that would require multifactor authentication and network segmentation, though we do not assume its final form here.

The defenses that proved durable are the ones the advisory pointed toward: tiered administration, phishing-resistant authentication for privileged access, segmentation, and backups that cannot be reached with domain credentials. Phishing-resistant authentication means methods, such as physical security keys, that cannot be tricked out of a user by a fake login page.

What did not hold up was the hope that takedowns would end the model. Decryptors, disruptions and shutdowns cost criminal groups money and time. They did not stop affiliates from moving to a new brand. Once inside, the directory still decides how far they go. That remains the most useful way to frame the problem: assume a credential will be lost one day, and make sure the damage it can do is small.