Critical Flaw in CrowdStrike Falcon Lets Attackers Disable Protection

Key Takeaways

• A sophisticated intrusion campaign, dubbed UTA-2026-024, has been identified, targeting a U.S. organization.
• Attackers leveraged common tools and deep network knowledge to disable endpoint protection, steal credentials, and maintain persistent access.
• The campaign utilized a Sliver command-and-control (C2) beacon and a unique Node.js implant that resolves its C2 server via an Ethereum smart contract.
• The use of a blockchain-based C2 infrastructure complicates traditional defensive measures like domain blocking.
• While the infrastructure is linked to a confirmed ransomware incident, no ransomware deployment was observed in this specific case.

A recent intrusion campaign has highlighted the alarming speed at which threat actors can commandeer a Windows domain and transform it into a staging ground for extensive compromise. This operation involved the deployment of a Sliver command-and-control (C2) beacon, the illicit creation of user accounts, sophisticated credential theft techniques, and the establishment of remote administration capabilities, all initiated from an initial breach.

The attack originated from an exposed server and targeted an unnamed organization within the United States. Analysis of the attack scripts revealed they were meticulously crafted for a specific Active Directory environment, indicating a planned rollout across at least 18 hosts. While the recovered artifacts did not confirm the deployment of ransomware in this particular incident, the underlying infrastructure has been linked to other confirmed ransomware attacks.

Analysts at The Hunter’s Ledger, who identified this operation as a high-risk post-exploitation toolkit and designated it UTA-2026-024, shared their findings with Cyber Security News (CSN). Their report noted that the attackers skillfully combined readily available public tools with an unusually detailed understanding of the victim’s network architecture. This combination resulted in a robust access package designed to neutralize security safeguards, exfiltrate credentials, and ensure persistent control channels.

Hackers Disable Endpoint Protection

Upon gaining initial access to the victim’s domain, the attackers executed scripts to create a new Active Directory account. This account was configured with a non-expiring password and immediately escalated to the Domain Admins group. Furthermore, they established a local administrator account, enabled Remote Desktop Protocol (RDP) access, and disabled Network Level Authentication (NLA), thereby broadening their potential pathways for lateral movement within the compromised network.

A critical step in their methodology involved scripts designed to halt and disable eight specific services associated with the victim’s endpoint protection solution. Following this, the scripts verified the status of each service to ensure they remained inactive. To facilitate offline password cracking, the attackers also harvested the SAM, SYSTEM, and SECURITY registry hives. Additional credential access vectors included an LSASS memory dump and the use of Mimikatz.

The persistence mechanisms employed in this campaign are particularly noteworthy. Scheduled tasks were created to run with SYSTEM privileges, featuring fabricated author details and backdated registration dates to evade detection. One recurring weekly task was observed downloading the latest attack chain dynamically, rather than relying on a fixed payload. This strategy is reminiscent of remote scheduled task delivery tactics seen in EtherRAT attacks.

In a further demonstration of their advanced capabilities, the attackers manipulated the victim’s DNS content filter through its administrative interface. They added their own malicious domain to the allowlist and subsequently inserted a corresponding record into the internal DNS. This maneuver allowed the attacker’s domain to resolve internally and bypass the very security controls designed to block it.

This pattern of exploiting legitimate administrative features for malicious ends is increasingly common in Windows intrusions. Recent reports on fake installer campaigns disabling Defender have also revealed attackers exploiting installer workflows and scheduled tasks to weaken security controls before establishing persistent access. In these scenarios, the primary threat is not a singular tool but the sophisticated sequence of actions employed.

Blockchain C2 Complicates Response

Beyond the Sliver beacon, the attackers deployed a Node.js implant that ingeniously retrieved its command server address from an Ethereum smart contract. Intriguingly, the initial domain recorded within this smart contract precisely matched the domain that was covertly inserted into the victim’s DNS configuration, establishing a direct link between these seemingly disparate operational elements.

Over a span of five months, the C2 domain within the Ethereum contract was updated five times, rendering simple domain blacklisting efforts largely ineffective. However, the smart contract itself remained immutable and publicly accessible, offering defenders a more stable point for tracking. Additionally, the associated beacon exhibited a consistent 60-second polling interval to its main server, a predictable pattern that can be leveraged for network hunting and detection.

What You Should Do

• Immediately initiate a comprehensive password reset across the entire affected domain, not just for accounts known to be compromised.
• Thoroughly audit all privileged group additions and SYSTEM-level scheduled tasks for any unauthorized or suspicious entries.
• Revert any modifications to your DNS allowlist and rotate the password for your DNS filter administrator.
• Remove any internal DNS entries that were not legitimately created by your organization.
• Actively search for instances where RDP is enabled with Network Level Authentication (NLA) disabled.
• Continuously monitor the Ethereum smart contract address 0xb3f2897f2bc797e5b9033faef8c81e92b01cb831 for any future changes to C2 domains.
• Prioritize behavioral detection rules over static signatures for public tools, as attackers frequently adapt their usage.
• Baseline normal scheduled tasks and configure alerts for any fileless download commands executing with SYSTEM privileges or abrupt changes to endpoint protection services.
• Examine related Windows tradecraft, such as Sliver implant activity targeting Germany and ransomware SYSTEM task abuse, to understand how common components are chained into enterprise-wide incidents.

Indicators of compromise (IoCs):-

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.