Hackers use Windows RID hijacking to create hidden admin account

AhnLab researchers report that the North Korean-linked Andariel group is using RID hijacking on Windows to convert hidden low-privilege local accounts into administrator accounts by modifying the SAM registry. The attack chain involves gaining SYSTEM access (via vulnerability exploitation and tools like PsExec and JuicyPotato), creating a hidden account, altering its RID with custom and open-source utilities, adding the account to Admin/RDP groups, and using registry export/restore techniques to hide tracks; mitigations include restricting privileged tool execution, protecting SAM access, monitoring LSA events, and enforcing MFA.