From VPN to Domain Admin: How Leaked Credentials Led to Full Compromise at TU/e [Fox-IT Report]

A declassified technical report from Fox-IT describes a large-scale incident response at Eindhoven University of Technology (TU/e) in the Netherlands, where a malicious actor used leaked VPN credentials to escalate to full domain administrator access via a DCSync attack. The adversary installed remote control tools such as AnyDesk and TeamViewer, compromised 91 systems, and attempted to disable backups.