---
id: 6011
title: "Egregor Ransomware Attack on Kmart is a Reminder that Active Directory Needs to Be Protected and Recoverable"
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/egregor-ransomware-attack-on-kmart-is-a-reminder-that-active-directory-needs-to-be-protected-and-recoverable/"
published_at: "2020-12-04T19:22:01Z"
tags: ["active-directory", "ransomware", "recovery", "kmart", "egregor", "maze"]
phying_url: "https://phying.com/item/6011"
lang: en
---

# Egregor Ransomware Attack on Kmart is a Reminder that Active Directory Needs to Be Protected and Recoverable

## Summary

Kmart's Egregor attack left its AD domain compromised, echoing Maze and Ryuk tactics: elevated AD access was abused to spread payloads—underlining the case for AD change monitoring, approval workflows and automated rollback.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2020-12-04T19:22:01Z
- **Original:** https://www.semperis.com/blog/egregor-ransomware-attack-on-kmart-is-a-reminder-that-active-directory-needs-to-be-protected-and-recoverable/
- **Phying News:** https://phying.com/item/6011