AhnLab reports that the Andariel threat group used RID Hijacking during intrusions to manipulate Windows account relative identifier values and elevate privileges. The technique can make a limited or guest account inherit administrator-like access, supporting persistence and stealth after compromise. The report links the behavior to Andariel operations involving malicious files and backdoor account creation, giving defenders concrete Windows account-abuse tradecraft to hunt.