Pass the Hash Attack Explained

SpecterOps argues identity risk now extends beyond Tier Zero, as attackers increasingly use legitimate credentials and trusted relationships to reach backups, regulated data, and other critical workloads.

A Halloween-themed open directory on a Hong Kong host exposed Cobalt Strike 4.2, exploit code, the BrowserGhost tool and a Goblin phishing kit aimed at Chinese-speaking education platforms.

Releases Invoke-DCSync, a PowerShell wrapper around Mimikatz's DCSync feature that impersonates a domain controller to dump account hashes without touching the DC.

Introduces Invoke-MassMimikatz-PsRemoting, which combines SPN discovery, PowerShell Remoting, and Invoke-Mimikatz to harvest credentials from many domain systems automatically.

Explains how Microsoft LAPS stores local admin passwords in LDAP, and how incorrect delegation on ms-MCS-AdmPwd can expose cleartext credentials that aid lateral movement.

Details five ways to find systems running Domain Admin processes: checking locally, querying domain controllers for sessions, scanning remote tasks, NetBIOS enumeration, and token spraying.