Chinese Hackers Hijack Auth Flow, Spy on Isolated Network for a Decade

**Chinese state-sponsored attackers owned an organization's authentication infrastructure and maintained undetected access for approximately ten years, gaining universal visibility into credentials and administrative actions; the report details attack phases (initial access, targeting directory/Kerberos/PAM/RADIUS, long-term passive collection), detection approaches (cryptographic integrity checks, out-of-band logging, Kerberos ticket analysis, network auth flow monitoring), and remediation guidance that includes rebuilding directory services, rotating krbtgt keys, and treating all credentials as compromised.**