Hackers Create Domain Admin Account and Disable Security Tools Inside Windows Network

A newly documented ransomware intrusion attributed to The Gentlemen shows how attackers can convert a foothold in a Windows environment into domain-wide control by elevating accounts, turning off endpoint defenses, and abusing trusted Active Directory infrastructure to distribute ransomware.

The operation illustrates a recurring enterprise risk: attackers do not need highly customized malware to compromise a Windows domain when they can repurpose legitimate administrative utilities, signed drivers, and native network shares for destructive activity.

Intel 471 reported that The Gentlemen typically enter through compromised credentials or exposed internet-facing services, then map the environment before targeting privileged identities and security controls.

Its reported targets include manufacturing, insurance, construction, consumer services, healthcare and financial-sector organizations.

The attack chain begins with access to a Windows environment through stolen credentials or exposed remote services, including VPN and firewall management interfaces.

Rather than deploying ransomware immediately, the operators conduct reconnaissance using Advanced IP Scanner to identify systems and locate administrative accounts across the network.

After identifying a path to elevated privileges, the attackers reportedly use PowerRun.exe, a legitimate Windows utility, to execute processes with high integrity.

This enables the group to manipulate accounts and establish durable access before initiating the destructive phase of the operation.

A particularly high-risk stage involves adding or elevating an account into privileged Windows groups such as Domain Admins.

Domain Admin membership provides extensive control over Active Directory resources and domain infrastructure, including the ability to write to network locations trusted by every domain-joined endpoint. Intel 471 maps this behavior to MITRE ATT&CK technique T1098, Account Manipulation.

With administrative access established, the threat actors move to neutralize antivirus and endpoint detection and response tools.

Researchers said The Gentlemen use an “AV Killer” capability that loads ThrottleBlood.sys, a legitimate signed Windows driver, and pairs it with a tool named All.exe to terminate security processes.

This technique reflects the growing operational value of bring-your-own-vulnerable-driver attacks.

Because the driver is legitimately signed, it may be allowed to load in environments that trust signed kernel code.

Hunt.io Researchers said that, the Gentlemen ransomware group, active since August 2025, has claimed hundreds of victims and has focused heavily on organizations in Asia-Pacific and North America.

Attackers can then abuse the vulnerable driver’s capabilities to interfere with or force-stop protective software before ransomware deployment.

Domain Admin Account Creation

The group also shuts down recovery-critical services, including Veeam backup components and SAP, Oracle and MySQL database services.

The /24 sits inside a /23 named AGROSNAB-NET-233-202, a direct structural relationship rather than an inference, and that /23 carries country RU, with OOO AGROSNAB as registrant and administrative and technical contacts declaring addresses in Yekaterinburg.

This reduces the victim’s ability to restore systems quickly and can increase pressure during extortion negotiations.

At the same time, operators stage and exfiltrate data using WinSCP over encrypted channels and maintain access through AnyDesk.

The final deployment phase abuses the NETLOGON share, a native Windows domain resource routinely accessed by domain-joined machines.

Once attackers have sufficient privileges, placing a ransomware payload in NETLOGON can enable broad and rapid distribution across the environment.

Reported attacks encrypted files with the .7mtzhh extension and dropped a ransom note named README-GENTLEMEN.

The group has also been observed abusing SYSVOL and other administrative shares, reinforcing why defenders should treat unexpected write activity to domain-controller shares as a high-priority alert.

Static indicators such as a driver filename or ransom-note name are useful for retrospective hunting, but they can be changed easily. Behavioral detection is more resilient.

Security teams should investigate Windows events and endpoint telemetry for account creations, privileged group membership changes and suspicious command-line activity involving net group or net localgroup with the /add parameter.

Intel 471 specifically recommends reviewing attempts to add users to Administrators, Domain Admins, Enterprise Admins, DnsAdmins, Hyper-V Administrators and Schema Admins.

A newly elevated account that subsequently authenticates across servers, runs remote administration tools or accesses NETLOGON should be treated as a potential active intrusion, particularly if no corresponding change ticket exists.

Analysts should also investigate signed but unusual driver loads, abrupt EDR service termination, disabled backups, anomalous PowerRun execution, AnyDesk activity and unapproved remote access software.

If domain compromise is suspected, organizations should isolate affected systems, disable compromised privileged accounts, block suspected exfiltration paths and rotate high-value credentials.

Incident responders should also assess whether the Active Directory database, NTDS.dit, was accessed or exfiltrated, because its compromise can expose password hashes for domain accounts and undermine trust across the entire Windows domain.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.