When a CISA advisory says to assume full domain compromise, it means an attacker with domain level access may hold credentials and trust material that survive a normal clean-up. Recovery then covers resetting all account secrets, resetting the krbtgt account twice, and rebuilding identity trust, not just removing malware.
Where the phrase comes from
The Volt Typhoon advisory from CISA, the NSA, the FBI and partner agencies says the actor primarily relies on valid credentials for persistence and extracts the NTDS.dit database from domain controllers, sometimes repeatedly, to keep credentials current. It says footholds have lasted at least five years. Because of this, it tells organisations that detect an intrusion to assume full domain compromise.
The SolarWinds Orion alert uses similar language: "Assume the environment has been compromised, and initiate incident response procedures immediately." It adds that where administrative credentials or SAML abuse are confirmed, the entire identity trust store should be treated as compromised.
What the advisories recommend
From the two documents:
- Reset passwords for all domain and local accounts.
- Reset the krbtgt account twice.
- Rotate credentials used by or stored in affected systems.
- Enable MFA where possible and enforce least privilege.
- If administrative credentials or SAML abuse are confirmed, fully reconstitute identity services.
- Remediate Kerberoasting and move service accounts to group managed service accounts, where applicable.
- Remove attacker-controlled accounts and persistence.
- Audit configurations and firmware of devices managed by affected servers, and change related secrets.
Why the order matters
Do not start resetting secrets before you understand what the attacker can still reach. If you reset a password while the attacker still holds a way back in, the new password may be captured too. Plan the reset as one coordinated event after you have scoped the intrusion and prepared clean systems.
Preparation checklist
- Identify who has domain admin and equivalent rights.
- Prepare out-of-band communication, since the SolarWinds alert says the actor targeted responders' email.
- List service accounts and where their secrets are stored.
- Check that logs reach back far enough to scope the intrusion.
- Decide who approves a downtime window.
- Test the krbtgt procedure in a lab, since it has dependencies in your own environment.
What if you are not on Windows domains
The principle holds: identify the root of trust in your identity system, and treat it as untrusted when there is evidence it was reached. For cloud identity, the SolarWinds alert also mentions federation trusts and credentials added to service principals as persistence methods, so review those.
Limits of this article
This is a summary of public advisories. For a live incident, follow your incident response plan and, where it applies, the full text of the advisory you are working from.
Quick check
Why reset krbtgt twice?
The advisories recommend it. Do it as the full procedure describes, with testing, since the account holds trust material for the domain.
Is removing the malware enough?
Not when valid credentials were stolen. The access can continue without any malware on the systems.
Sources
Last reviewed: 19 October 2026.
