---
id: 6018
title: "The Weaponization of Active Directory: An Inside Look at Ransomware Attacks Ryuk, Maze, and SaveTheQueen"
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/the-weaponization-of-active-directory-an-inside-look-at-ransomware-attacks-ryuk-maze-and-savethequeen/"
published_at: "2020-10-02T13:04:52Z"
tags: ["active-directory", "ransomware", "bloodhound", "zerologon", "maze", "ryuk"]
phying_url: "https://phying.com/item/6018"
lang: en
---

# The Weaponization of Active Directory: An Inside Look at Ransomware Attacks Ryuk, Maze, and SaveTheQueen

## Summary

How Ryuk, Maze and SaveTheQueen weaponized Active Directory: human-operated campaigns chain TrickBot/Emotet loaders into Cobalt Strike, then use BloodHound/SharpHound and Mimikatz for AD recon and credential theft—against the Zerologon backdrop.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2020-10-02T13:04:52Z
- **Original:** https://www.semperis.com/blog/the-weaponization-of-active-directory-an-inside-look-at-ransomware-attacks-ryuk-maze-and-savethequeen/
- **Phying News:** https://phying.com/item/6018