March 2019: In the halls of Norwegian aluminum producer Norsk Hydro, the conveyor belts suddenly grind to a halt. A single click on an unremarkable workday unleashed a digital chain reaction. It all began with a disguised email that landed unnoticed in an employee's inbox. When the malicious file was opened — no warning, no alarm. But behind the facade, the attack had already begun.
Silently, and completely unnoticed by the security systems, the attack ate its way from that one standard user account, step by step, through the entire nerve center of the corporation. Belts stood still worldwide. Smelting furnaces had to be operated manually.
Financial damage of more than 70 million dollars — triggered by a path that started at a single employee's PC and ended at the very top of the entire network hierarchy. From standard user to domain admin — in a single attack chain.
Why Active Directory is the real target
The Active Directory is a directory service developed by Microsoft for Windows networks. Essentially, you can think of it as a central address book and phone directory — only with far more capabilities for administrators to manage, edit, query, and structure stored user and object data.
Once inside the internal network, Active Directory forms the central identity and permissions management for the entire organization. Whoever controls it controls every user, every machine, and every permission on the network.
Attackers move from low-level privileges (standard user) step by step, both vertically and horizontally, through the network — until they've taken control of that very address book.
Attackers often deliberately combine lateral movement and privilege escalation to reach increasingly critical resources while staying under the radar of security monitoring.
From reconnaissance to full takeover
Every successful compromise can be broken down into a chain of successive phases — known as the Cyber Kill Chain or the MITRE ATT&CK Framework.
Cyber Kill Chain: A model describing the phases of a cyberattack — from reconnaissance to execution.
| Phase | Explanation | Example |
|---|---|---|
| 1. Reconnaissance | The attacker passively/actively gathers information about the target organization to find points of entry. | Scraping employee emails from LinkedIn or scanning open server ports |
| 2. Weaponization | The attacker combines an inconspicuous document or piece of software with malicious code into a usable exploit payload. | Creating a crafted PDF file that executes a malicious script when opened |
| 3. Delivery | The prepared malicious code is transmitted to the victim via a delivery channel. | Sending a disguised phishing email with a malicious attachment to the purchasing department |
| 4. Exploitation | The malicious code is executed on the target system, exploiting a vulnerability or human carelessness. | The employee clicks the attachment, triggering code that exploits a flaw in the reader software |
| 5. Installation | The attacker embeds themselves permanently on the compromised system to secure access even after a reboot. | Placing a backdoor in the Windows autostart registry |
| 6. Command & Control | The infected system establishes an encrypted communication channel to the attacker's server. | The machine covertly connects to an external server over HTTPS to receive commands |
| 7. Actions on Objectives | The attacker carries out their actual goals within the network, such as data theft, sabotage, or extortion. | Harvesting passwords, browsing network shares, and encrypting servers |
When it comes to Active Directory and real corporate networks, though, this model has a weakness: it almost completely ignores what happens inside your network. Everything that occurs after initial access is lumped indiscriminately into phase 7 by the classic kill chain. This is exactly the gap the Phishing-to-Domain-Admin model (PtDA) closes, zooming right into the middle of the action:
The phases of the Phishing-to-Domain-Admin model show, step by step, how attackers explore the network, escalate privileges, move from machine to machine, and ultimately take over Active Directory entirely — exposing the blind spot the classic kill chain leaves behind.
A foot in the door
The basic principle of phishing is to convince someone to click a malicious link or run a harmful attachment. Phishing, however, is no longer limited to classic mass emails — the overview below compares the different attack vectors directly:
| Vector | Principle | Example |
|---|---|---|
| Spear Phishing | A specific person or group is lured into clicking a malicious link. | The group Water Makara ran a campaign against Brazilian companies using disguised tax documents that delivered the Astaroth banking malware (Oct. 2024) |
| Whaling | An even more targeted form, usually aimed at CEOs, CFOs, or other executives. | Austrian company FACC lost over €42 million in 2016 — attackers posed as the CEO and emailed the finance department |
| Smishing | Attack via SMS or messaging services — considered more effective, since messaging apps feel more trustworthy than email inboxes. | In late 2024, scammers posed as the IRS to steal personal data such as home addresses and tax ID numbers |
| Vishing | Attack carried out over a plain phone call, targeting confidential data or company information. | In December 2024, an attacker posed as a client over Microsoft Teams and tricked a victim into installing AnyDesk — resulting in unrestricted remote access |
| Quishing | Like classic phishing, except the malicious link is embedded in a QR code. | In August 2024, fake QR codes were placed in parking lots, redirecting payments straight to the attackers |
Recon: Who am I, and where am I?
Scanning the environment: The hacker quietly looks around the infected machine. Who am I? What operating system is running? What protective software is active? What servers exist on the network?
Finding attack paths: Using tools, the attacker then scans the corporate network — the Active Directory — to figure out which vulnerabilities exist and where the administrators are located.
Stealing credentials & privilege escalation
On the first machine, the attacker usually only has normal user rights. To move forward, they need to gain stronger privileges or capture credentials stored on the system.
Depending on the system, the attacker tries to capture credentials such as plaintext passwords or hashes from memory — for example from the LSASS process (credential dumping). If security updates are missing, attackers often exploit operating-system kernel vulnerabilities to jump their privileges directly from normal user to system level.
Lateral movement: from machine to machine
A single machine isn't enough for the attacker. They use the captured credentials to hop through the network from machine to machine until they reach their actual target.
The attacker specifically looks for systems where an IT administrator has recently logged in. Once they log in there themselves, they can capture the admin's credentials directly from that machine's memory.
Domain admin: the ultimate goal is reached
The attacker reaches the ultimate goal: they gain complete control over Active Directory — the central management of all users and machines — and become domain admin.
Once the attacker has captured a domain admin's credentials, they log in to the main server (domain controller). From that moment on, they can create new users, change passwords, and lift any security restriction. The entire network belongs to them.
Defense-in-depth: addressing every phase
An effective security strategy has to address every phase of the attack path. It makes particular sense to focus on blocking the early phases as early as possible — the sooner the chain is broken, the less severe the outcome for the organization.
Phase 1 · Phishing
- Regular security awareness training against social engineering, especially phishing and its variants
- Mail filtering & link rewriting: dynamic inspection of links and attachments both on arrival and at the moment of clicking
- Application control: blocking the execution of scripting languages such as PowerShell or JavaScript
Phase 2 · Reconnaissance
- Zero-trust architecture: no direct communication allowed between normal clients
- Firewalls to limit the visibility of internal servers and services
- Honeypots & decoy objects: fake admin accounts or shares that trigger an immediate alert on access
Phase 3 · Stealing credentials & escalating privileges
- Principle of least privilege: removing local administrator rights for standard users
- Attack surface reduction: e.g., blocking Office applications from spawning child processes
- LSASS protection: enabling Credential Guard on Windows to encapsulate credentials in memory
Phase 4 · Moving through the network
- Introducing strict password policies
- Regularly changing passwords after a defined period
Phase 5 · Full takeover
- Domain controller hardening as the last line of defense
- Monitoring via SIEM / Active Directory monitoring: central analysis of event logs for suspicious privilege changes
- Regularly tested, offline or read-only disaster-recovery plans as protection against ransomware
Not a Hollywood hack, but a logical process
A successful cyberattack — from the first phishing email to the complete takeover of the domain — is rarely a magical hack out of a Hollywood movie. It's a logical, often automated process, in which attackers chain together small gaps, inadequate permission structures, and human carelessness step by step.
Security doesn't come from a single product — it comes from an ongoing process: defense-in-depth. Anyone who hardens Active Directory, cuts off paths for lateral movement, and relies on modern identity verification takes away the attacker's room to maneuver — even if the first phishing email does reach its target.
The rule holds: the earlier an attack can be identified and contained along its path, the more lightly an organization gets away, and the more the impact is limited.
- Deepfake Vishing – How AI voice clones take vishing attacks to a new level
- Quishing – Why today's most harmless-looking scan can compromise your network
- What a breach really costs – Production downtime, incident response costs, lost customers, and personal liability
Do you really believe your domain admin is safe from attackers?
We test your systems under realistic conditions before a real attacker does — from the first phishing attempt to a full takeover of Active Directory. Free initial consultation.
Request a consultation →