CISA: Admin Credentials of a Former Employee Leveraged to Compromise a State Government Organization

Cybersecurity and Infrastructure Security Agency (CISA) and Multi-State Information Sharing & Analysis Center (MS-ISAC) conducted an incident response assessment of a state government organization’s network environment after documents with host and user information, including metadata, were posted on a dark web brokerage site. An analysis confirmed that an unknown threat actor compromised network administrator credentials through the account of a former employee—a technique commonly used by threat actors—and was able to successfully authenticate to an internal virtual private network (VPN) access point, navigate the victim’s on-premises environment, and perform various lightweight directory access protocol (LDAP) queries against a domain controller.

It is imperative that Japanese companies handle the Dormat account, as well as ensuring that no longer needed accounts are disabled, MFA should be enabled, and passwords should be stored securely.