All the passwords were stored in Active Directory description fields
A UK firm stored service-account passwords in Active Directory description fields, making them easy to read and reuse. Attackers later found them, gained domain access, and launched ransomware.
Intelligence analysis by GPT-5.4 Mini
The Register recounts a case where developers and admins put cleartext passwords in Active Directory description fields because there was no proper vault. That shortcut turned into a major breach when attackers queried AD, found the credentials, and used them to wipe backups and deploy ransomware.
It was like writing the house keys on the mailbox where almost anyone could read them. When thieves found the note, they could open every door, lock up the owners, and make a huge mess.
Analysis
What happened
Rob Anderson of Reliance Cyber describes a company that needed service accounts for developers but did not have a proper password vault. Instead of using a secure secrets store, the organization placed passwords in Active Directory description fields so staff could find them easily.
That choice mattered because, as Anderson notes, ordinary AD users can often read comments or description fields across the directory. In other words, a field intended for notes became a secret repository visible to far more people and systems than intended.
How attackers used it
The story says an Initial Access Broker gained a foothold through phishing and the Sliver offensive tool. After capturing a victim's credentials, the intruder queried Active Directory and found a set of passwords with full domain access. Those credentials were then used to delete backups and execute ransomware.
The impact was severe: more than 2,000 users were affected when Hyper-V hypervisors and their hosts were encrypted. The company was taken offline for months.
The lesson
The article's core warning is simple: do not store passwords in cleartext in places that are broadly readable. The risk is not limited to outside attackers. A malicious or careless insider could also expose or sell those credentials. Anderson also points to a broader pattern where configuration files and application servers leak secrets when teams assume attackers will not look there.
The takeaway is less about AD itself and more about secret handling discipline. If credentials are easy to read, they are easy to steal, and once they are stolen they can turn a routine compromise into a domain-wide disaster.
Key points
- The company stored service-account passwords in Active Directory description fields because it lacked a proper vault.
- A security researcher said ordinary AD users can often read those fields across the directory.
- Attackers reportedly phished a user, ran Sliver, and then used the stolen credentials to query AD.
- The stolen passwords gave full domain access, which was then used to delete backups and deploy ransomware.
- The incident left more than 2,000 users affected and took the company offline for months.
The story gives security teams a concrete example to use when pushing for a real password vault and tighter secrets handling. If organizations take that lesson seriously, they can reduce the chance that one stolen credential turns into a domain-wide breach.
If teams keep treating directory fields and config files like harmless note pads, attackers will keep finding easy paths to powerful credentials. The result can be backup deletion, ransomware, and long outages that affect thousands of users.
