With DCShadow, attackers no longer have to replicate data, but can register new domain controllers in the targeted infrastructure to inject backdoor changes in AD objects, or alter existing ones by replacing the attributes’ values.