A large enterprise recently suffered a complete ransomware catastrophe after a routine phishing email led attackers directly to a treasure trove of passwords stored in plain text within Active Directory. The passwords were not hidden in a secure vault or encrypted configuration file. They were sitting in the Description field of user and service accounts, visible to every authenticated user on the domain. The incident, detailed by Rob Anderson of the cybersecurity firm Reliance Cyber, serves as a stark warning about a fundamental and widely overlooked security flaw in Active Directory design.
How Any Authenticated User Can Read Password Data in Active Directory
At the heart of this incident is a deeply ingrained design feature of Active Directory: the Description and Comment fields of every user, group, and computer object are readable by default by any authenticated user on the domain. No administrative privileges are required. If a user account is logged into a domain-joined machine, that user can query the entire Active Directory database with a single LDAP command and see the contents of every Description field across the entire organization.
This open access was not an oversight. It was a deliberate design decision dating back to the Windows 2000 era. A security group called Pre-Windows 2000 Compatible Access was created to maintain backward compatibility with legacy systems. This group, which is still in effect today on Windows Server 2025 installations, includes the Authenticated Users built-in group by default. This means every person who logs into the domain inherits read rights to these fields. The default setting has remained unchanged for over two decades.
The Attack Chain: From a Single Phishing Email to Total Network Collapse
The attack on this company began with an Initial Access Broker (IAB), a type of cybercriminal who specializes in breaking into networks and then selling that access to other criminals, typically ransomware groups. The attack unfolded in a clear and predictable sequence of events.
Phase 1: Initial Compromise. An employee received a phishing email that successfully executed the Sliver command-and-control framework on their endpoint. Sliver is an open-source adversary simulation tool that is increasingly popular among real-world attackers. The attacker used this foothold to steal valid credentials from the compromised machine.
Phase 2: Credential Harvesting via Active Directory. With valid domain credentials in hand, the attacker performed a standard directory enumeration. Using a simple LDAP query, they searched the Description fields of all user and service accounts across the entire domain. The result was devastating: a complete list of plaintext passwords for every service account in the organization.
| Phishing email delivering Sliver C2 framework |
| Credentials stolen from compromised endpoint |
| Active Directory Description field queried for passwords |
| All service account passwords extracted |
| Domain administrator privileges escalated |
| All backups deleted |
| Ransomware deployed across Hyper-V and physical hosts |
| Over 2,000 users locked out for months |
Phase 3: Escalation to Full Domain Control. With the list of service account credentials, the attacker likely identified accounts with privileged access. From there, escalating to full Domain Administrator privileges was a matter of using standard lateral movement techniques. Once they held the keys to the domain, the damage accelerated rapidly.
Phase 4: Backup Deletion and Ransomware Deployment. The attackers systematically deleted every backup they could find across the network. With recovery options eliminated, they deployed ransomware that encrypted Hyper-V virtual machine hosts and physical servers alike. More than 2,000 employees were rendered unable to work. The company faced a multi-month outage with no backups to restore from.
The Root Cause: A Missing Password Management Tool
The company that suffered this breach did not have a dedicated password management tool. The exact reason remains unclear. It could have been cost, operational inertia, or simply the lack of awareness of the risk. Whatever the reason, the absence of a password manager forced IT staff to store credentials in the most convenient place available: the Active Directory Description field.
The consequences speak for themselves. The cost of a ransomware incident involving a multi-month outage for over 2,000 users, lost productivity, forensic investigation, legal fees, and potential regulatory fines will almost certainly dwarf the annual license cost of any enterprise password management solution. Products like HashiCorp Vault, CyberArk, and 1Password Business are not optional luxuries. They are a fundamental security control that directly addresses this class of vulnerability.
How Attackers Find Plaintext Passwords in Files
The Active Directory Description field was not the only risk exposed in this case. Anderson also highlighted a related tactic: attackers search for configuration files on application servers that contain hardcoded credentials. This is commonly done through fuzzing, where attackers try a list of common file names and directory paths across a server looking for a hit.
Common files like web.configcodecodecodecode, appsettings.jsoncodecodecodecode, database.phpcodecodecodecode, and config.inicodecodecodecode are goldmines for attackers. When a developer leaves a database password or API key in clear text in such a file, the attacker can extract it without needing to compromise a user account at all. This approach is frequently automated and runs silently across the internet.
Even CISA Committed the Same Mistake
If this were only a story about a single company, it might be easier to dismiss as a localized failure. But in May 2026, a security researcher discovered that a contractor working for the United States Cybersecurity and Infrastructure Security Agency (CISA) had uploaded AWS administrator credentials and other plaintext passwords to a public GitHub repository for nearly six months.
The repository was named “Private-CISA.” Despite the name, the repository itself was set to public. GitGuardian, a company specializing in detecting leaked secrets, found the exposed credentials and notified CISA. The agency took 26 hours to set the repository to private. The researcher who discovered the leak described it as “the worst breach of a career.”
If even the agency tasked with defending the nation’s critical infrastructure can mishandle plaintext passwords at this level, it is a clear signal that password hygiene remains a systemic problem across the entire industry.
The Growing Insider Threat with Stolen Credentials
The risk of plaintext credentials does not only come from external attackers. A recent survey by the UK fraud prevention organization Cifas, published in May 2026, found that one in eight employees (13 percent) admitted to having sold their company login credentials or knowing someone who had. This statistic reveals a troubling normalization of credential theft from within the organization.
When an employee leaves a company or faces financial pressure, the credentials they have memorized or written down become a direct threat. If those same credentials are also stored in plaintext in Active Directory or a configuration file, the insider risk multiplies exponentially. An external attacker only needs one foothold to move laterally. An insider already has legitimate access and knows exactly where to look.
Three Immediate Actions to Close This Vulnerability
For any organization still using Active Directory, the severity of this default exposure requires immediate action.
1. Audit the Description and Comment fields immediately. Run the following PowerShell command across the domain: Get-ADUser -Filter * -Properties Description | Where-Object {$_.Description -ne $null}codecodecodecode. This will return every user account where the Description field is not empty. Service accounts must be included in the query. If any credential, password hint, or sensitive string appears, it must be removed.
2. Deploy a dedicated enterprise password management solution. The goal is to create an environment where plaintext passwords have no reason to exist in Active Directory fields, configuration files, Excel spreadsheets, or chat messages. Tools like HashiCorp Vault, CyberArk, and 1Password Business allow service accounts to retrieve credentials dynamically with audit trails and rotation policies.
3. Prune unused and orphaned service accounts. Many organizations accumulate service accounts over years or decades. Accounts created for a specific project that has long since ended, accounts whose passwords were last changed years ago, and accounts whose purpose is completely unknown are a massive security liability. Attackers specifically target these legacy accounts because their owners are not paying attention. The service account used in the incident described here was exactly that kind of orphaned, unmonitored credential.
The Fundamental Lesson: Design Assumptions Kill
Active Directory remains the backbone of authentication for most enterprises worldwide. Its design choices from the early 2000s have powerful and unintended security consequences today. The fact that the Description field is readable by any authenticated user is not a vulnerability in the traditional sense. It is a design feature that was perfectly reasonable in an era of on-premises-only networks and trusted employees. In today’s threat landscape, that same feature is a direct pipeline to total network compromise.
Organizations have the means to fix this. But as the CISA repository incident shows, awareness alone is not enough. The structural and cultural disciplines of password management must be enforced at every level of the organization, from the helpdesk administrator to the highest ranks of government cybersecurity. Otherwise, the next phishing email will once again find a password sitting exactly where it should not be.
