Insider Active Directory Sabotage: A Hidden VM Used to Schedule Account Deletions and Password Resets

1. Basic Information

• Article Name: Former Employee of Industrial Company Sentenced to 32 Months in Prison for Computer Attack and Extortion
• Source: U.S. Department of Justice / U.S. Attorney’s Office, District of New Jersey
• Publication Date: 2026-10-05
• Updated Date: 2026-10-05
• Original: DOJ Sentencing Announcement
• Related Sources: FBI Criminal Complaint (Signed August 8, 2024, PDF), SecurityWeek Coverage (October 10, 2026)
• Related Malware: None specified
• Related Threat Groups: None specified (Insider threat by a former employee)
• Related CVEs: None
• Related Products and Technologies: Windows Active Directory, Windows Task Scheduler, RDP, Sysinternals PsPasswd
• Severity: High (A 2023 incident reaffirmed by a 2026 DOJ sentencing announcement; not an ongoing attack)

2. Quick Summary

In a 2023 insider incident, an employee used RDP to connect from a hidden virtual machine to a domain controller and created approximately 16 unauthorized scheduled tasks. The attacker deleted administrator accounts, changed a large number of passwords, and demanded 20 BTC.

3. Attack Flow

This incident follows an abuse of high-privilege insider access -> task registration -> account modification -> extortion chain. The Department of Justice announced the sentencing, and an FBI affidavit specifically documents the timeline of operations and the legitimate tools used.

1. Preparation and Access to an Administrator Account: The attacker used an unauthorized virtual machine, created around November 9, 2023, to connect to a domain controller (DC) via RDP. The affidavit documents the use of an administrator account and links the activity to the employee's workstation and home IP address.
2. Deployment of Management Tools and Task Registration: Around November 15, PsPasswd was placed on the DC. On the morning of November 25, the attacker created approximately 16 scheduled tasks using a legitimate administrator account.
3. Execution Around 16:00 on the Same Day: Six of these tasks were configured to delete 13 domain administrator accounts, change passwords for 301 domain user accounts, and update local administrator passwords affecting 254 servers and 3,284 workstations. Administrators confirmed the deletions and password reset notifications. The tools used were net user and PsPasswd.
4. Extortion and Notice of Additional Shutdowns: Around 16:44, an email demanding payment of 20 BTC was sent. Other tasks were configured to shut down servers starting on December 3, but successful execution of those shutdowns has not been confirmed. The email's claim that all backups had been deleted is also not supported by independent evidence.

4. Attacker Position and Execution Location

• The attacker was employed by the company as an infrastructure engineer at the time and abused privileged internal access rather than exploiting an external vulnerability.
• According to the affidavit, the attacker used an employee workstation to pivot through an unauthorized VM, establishing an RDP connection to domain administrator accounts on the DC.
• Inference: It is necessary to correlate privileged accounts with source VMs, operating terminals, and administrator approvals.

5. Victim and Administrator Perspective

• Users: Manifests as unexpected password changes or lockouts.
• Administrators: Received multiple password reset notifications around 16:00 on November 25, 2023, and confirmed the deletion of other domain administrator accounts. Roughly 16 unauthorized tasks on the DC and RDP sessions from an unauthorized VM serve as investigation clues.

6. Success and Failure Conditions

Success Conditions

• Establishing an RDP connection to the DC with administrator privileges to register and execute scheduled tasks.
• Successfully modifying domain and local administrator passwords using net user and PsPasswd.

Failure Conditions and Defenses

• Restricting management VMs to an authorized asset inventory and limiting high-privilege connection sources to the DC.
• Cross-referencing high-privilege task creation and mass password changes with approved changes to detect and stop them before their scheduled execution times.

7. What Happens Upon Success

• The tasks were configured to delete 13 domain administrator accounts and change 301 user passwords. The affidavit records that administrators confirmed the deletion of other admin accounts and numerous password reset notifications. Completion of all configured modifications could not be fully verified.
• The 254 servers and 3,284 workstations represent the scope of targeted endpoints for the local administrator password changes set in the tasks, not necessarily the number of machines where changes or shutdowns were confirmed completed.
• The December server shutdowns and total backup deletion are distinct from events with confirmed execution and success.

8. Observable Logs

The following points are based on published investigative evidence, along with recommended records for investigating similar incidents within an organization. Audit events depend on configuration and retention settings.

• Email: Message headers, sender addresses, and receive timestamps (around November 25, 2023, 16:44 EST) of the extortion email.
• Proxy / SWG / DNS: Search and external access logs related to management operations performed on unauthorized VMs. Searches alone do not indicate successful disruption.
• Endpoint / EDR: Execution histories of net user and PsPasswd on the DC, process and task creation logs, and traces of management terminals and unauthorized VMs.
• Identity / IdP: If auditing is enabled, domain account changes can be verified in DC security logs, while local account changes appear in the security logs of target servers and endpoints. For Event ID 4724 (password reset attempt), distinguish between Audit Success and Audit Failure records and correlate them with Event ID 4726 (account deletion) and Event ID 4624 (logon), using the recording host, target account, and account that performed the action.
• SaaS / Cloud: VM creation, connection, and modification logs in the virtualization infrastructure. There is no confirmation that cloud environments were used in the offense.
• Network: Correlating access records from assigned workstations to unauthorized VMs, RDP connections from unauthorized VMs to the DC, and employee home IP connections to the corporate network.

9. Attack Success Assessment

Confirmed in Public Information

• Subsequent Compromise Confirmed: The FBI affidavit documents the creation of unauthorized tasks as well as same-day password reset notifications and administrator account deletions.
• Unconfirmed: Successful execution of server shutdown tasks scheduled for December, total backup deletion, and shutdowns of all endpoints.

Internal Determination Criteria

• Task registration alone does not constitute successful execution. Correlate task execution times, net user/PsPasswd executions, and audit records of individual account changes.
• Server shutdowns and backup deletions must be proven separately using service stoppage logs and backup management logs.

10. Investigation Playbook

• Starting Point of Investigation: Detect high-privilege task creation or mass account modifications on the DC.
• Initial Verification: Preserve task definitions, creators, execution times, change approvals, target accounts, and audit logs.
• Endpoints and Servers: Investigate RDP, process, and task execution artifacts on the DC and management VMs.
• Authentication and Cloud: Correlate administrator account usage, external connection sources, VM creation history, and authentication records.
• Subsequent Actions: Verify additional tasks, scheduled shutdowns, backup operations, and existing log deletions.
• Containment: Preserve evidence, stop unauthorized tasks, suspend compromised management accounts, and restore administrative privileges following recovery procedures.
• Evaluation Categories: Independently evaluate the stages of task registration, account modification, server shutdown, backup deletion, and extortion.

11. Defense and Detection Ideas

• Single Events: Prioritize investigation of unauthorized task creation on DCs, privileged account deletions, and numerous password resets.
• Timeline Correlation: Correlate RDP from unauthorized VMs -> DC task registration -> net user/PsPasswd -> rapid mass account modifications.
• Threat Hunting: Hunt for VMs outside normal management connection sources, scheduled administrative tasks, and local administrator password changes spanning endpoints.
• Log Limitations: Without task, authentication, and VM management logs, distinguishing legitimate operational changes from insider threats becomes difficult.
• Priority Countermeasures: Verify DC connection source restrictions, management VM asset inventories, independent approvals for privileged tasks and mass password changes, and the segregation of recovery administrator credentials.

12. Facts / Inference / Hypothesis

Facts

• The FBI affidavit records that RDP connections were established from an unauthorized VM to the DC to create approximately 16 tasks.
• Administrator deletions and password changes using net user and PsPasswd were configured, and password reset notifications received by administrators and account deletions were confirmed on November 25.
• The server shutdown scheduled for December was confirmed only at the configuration level, and total backup deletion is a claim made in the extortion email.
• The DOJ announced the 32-month prison sentence handed down on September 28, 2026, on October 5, 2026.

Inference

• Connecting change requests, management VMs, RDP, privileged accounts, tasks, and account modifications along a timeline helps uncover insider threats utilizing legitimate tools.

Hypothesis

No additional hypotheses. Unverified items are listed in "14. Unknowns and Additional Investigation".

13. MITRE ATT&CK Mapping

14. Unknowns and Additional Investigation

• The factual accuracy of the backup deletion mentioned in the extortion email remains unverified.
• Whether the server shutdown tasks scheduled to begin on December 3 were successfully executed remains unconfirmed.
• SecurityWeek reported that tasks completed on the evening of November 25, 2023. In addition to admin deletions and password reset notifications, paragraph 23 of the FBI affidavit mentions post-change passwords for 301 domain user accounts. However, completion of local admin password changes across all 254 servers and 3,284 workstations, as well as the execution success of the December shutdown tasks, cannot be confirmed.
• The duration of the outage, impact on all systems, audit log configurations, and total financial loss cannot be determined from public records alone.

15. Impact on SOCs and Organizations

This was a 2023 insider incident in the United States; effects in Japan or a new attack in 2026 have not been confirmed. Organizations operating Active Directory should inventory management access sources for domain controllers and virtual machines within their environments, and correlate scheduled task creation, rapid mass account modifications, and removal of administrator privileges. Because legitimate administrator credentials and standard tools can also be misused, organizations should cross-reference change approvals, operational audit trails, and physical access logs.

16. Summary by Target Audience

• For SOCs: Correlate high-privilege RDP from hidden VMs -> DC task registration -> net user/PsPasswd -> numerous account changes, distinguishing between extortion email claims and verified operations.
• For Administrators: Inspect DC management access origins, management VMs, task creation privileges, approval and auditing of mass account changes, and the segregation of recovery administrator accounts and backups.
• For Users: If unexpected password changes or sudden log-in failures are noticed, verify whether they correspond to normal administrative changes.