Attackers Downgrade WDigest Protection to Dump Plaintext Credentials With Mimikatz

Gbhackers •Mayura Kathir • July 2, 2026

An incident that began with innocuous enumeration commands but quickly escalated into a focused, multi-stage effort to impair detection and extract credentials. The intruder uploaded a steganographic webshell to an IIS server, used the process w3wp.exe to run OS reconnaissance such as whoami, and then deployed an extensive defence-impairment script (i.bat) that prefaced a credential-dump […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Attackers Exploit WDigest Vulnerability to Harvest Plaintext Credentials A multi-stage cyber attack targeted IIS servers, beginning with enumeration commands and escalating to credential extraction using Mimikatz. The attackers uploaded a steganographic webshell and executed a defense-impairment script (i.bat) that disabled logging and security services. Initial forensics indicated exploitation of Adobe ColdFusion vulnerabilities (CVE-2023-26360, CVE-2023-29298, CVE-2023-29300). The attackers employed steganography to conceal the webshell and manipulated Windows credential protections by enabling plaintext storage in memory. They also altered Microsoft Defender settings to disable monitoring, facilitating data exfiltration. The attack's scope included targeting Western and European environments, with the adversary returning to the compromised server after initial remediation efforts. The incident highlights significant risks associated with unpatched vulnerabilities and inadequate logging. 3 sources 74

Extracted Entities

Attackers Downgrade WDigest Protection to Dump Plaintext Credentials With Mimikatz

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (3)

Platforms (1)

Tools (1)