Hackers Steal Active Directory Password Hashes Without Attacking Domain Controllers Directly