After an initial infection, a threat actor gained access to a company's domain controller, giving them full admin access over the network and leaving the business at their mercy.