Latest NTLM news

Hackers steal Windows NTLM authentication hashes in phishing attacks

The hacking group known as TA577 has recently shifted tactics by using phishing emails to steal NT LAN Manager (NTLM) authentication hashes to perform account hijacks.
- Bill Toulas
- March 04, 2024
- 04:15 PM
- 2
Veeam warns of critical bugs in Veeam ONE monitoring platform

Veeam released hotfixes today to address four vulnerabilities in the company's Veeam ONE IT infrastructure monitoring and analytics platform, two of them critical.
- Sergiu Gatlan
- November 06, 2023
- 04:58 PM
- 0
Microsoft plans to kill off NTLM authentication in Windows 11

Microsoft announced earlier this week that the NTLM authentication protocol will be killed off in Windows 11 in the future.
- Sergiu Gatlan
- October 13, 2023
- 12:46 PM
- 3
New Windows 11 feature blocks NTLM-based attacks over SMB

Microsoft added a new security feature to Windows 11 that lets admins block NTLM over SMB to prevent pass-the-hash, NTLM relay, or password-cracking attacks.
- Sergiu Gatlan
- September 13, 2023
- 02:27 PM
- 0
Sponsored Content
Pass-the-Hash Attacks and How to Prevent them in Windows Domains

Hackers often start out with nothing more than a low-level user account and then work to gain additional privileges that will allow them to take over the network. One of the methods that is commonly used to acquire these privileges is a pass-the-hash attack. Here are five steps to prevent a pass-the-hash attack in a Windows domain.
- Sponsored by Specops
- September 27, 2022
- 10:05 AM
- 0
Windows 'RemotePotato0' zero-day gets an unofficial patch

A privilege escalation vulnerability impacting all Windows versions that can let threat actors gain domain admin privileges through an NTLM relay attack has received unofficial patches after Microsoft tagged it as "won't fix."
- Sergiu Gatlan
- January 13, 2022
- 12:31 PM
- 0
Microsoft shares mitigations for new PetitPotam NTLM relay attack

Microsoft has released mitigations for the new PetitPotam NTLM relay attack that allows taking over a domain controller or other Windows servers.
- Ionut Ilascu
- July 24, 2021
- 07:38 PM
- 0
Windows 10 themes can be abused to steal Windows passwords

Specially crafted Windows 10 themes and theme packs can be used in 'Pass-the-Hash' attacks to steal Windows account credentials from unsuspecting users.
- Lawrence Abrams
- September 07, 2020
- 12:38 PM
- 2
Russian hackers tried to steal San Francisco airport Windows accounts

The hack of employee web sites belonging to the San Francisco International Airport has been attributed to a Russian hacker group who used the SMB protocol to steal Windows passwords.
- Lawrence Abrams
- April 14, 2020
- 10:14 AM
- 0
Zoom Lets Attackers Steal Windows Credentials, Run Programs via UNC Links

The Zoom Windows client is vulnerable to UNC path injection in the client's chat feature that could allow attackers to steal the Windows credentials of users who click on the link.
- Lawrence Abrams
- March 31, 2020
- 11:59 PM
- 8
New Microsoft NTLM Flaws May Allow Full Domain Compromise

Two security vulnerabilities in Microsoft's NTLM authentication protocol allow attackers to bypass the MIC (Message Integrity Code) protection and downgrade NTLM security features leading to full domain compromise of a network.
- Sergiu Gatlan
- October 09, 2019
- 11:15 AM
- 1
Microsoft NTLM Flaws Expose All Windows Machines to RCE Attacks

Two critical vulnerabilities in Microsoft's NTLM authentication protocol consisting of three logical flaws make it possible for attackers to run remote code and authenticate on machines running any Windows version.
- Sergiu Gatlan
- June 11, 2019
- 01:05 PM
- 0
PDF Files Can Be Abused to Steal Windows Credentials

PDF files can be weaponized by malicious actors to steal Windows credentials (NTLM hashes) without any user interaction, and only by opening a file, according to Assaf Baharav, a security researcher with cyber-security Check Point.
- Catalin Cimpanu
- April 27, 2018
- 12:21 PM
- 6
Microsoft Word subDoc Feature Abused to Steal Windows Credentials

The security research team at Rhino Labs, a US-based cyber-security company, has discovered that malicious actors can use a lesser-known Microsoft Word feature called subDoc to trick Windows computers into handing over their NTLM hashes, the standard format in which user account credentials are stored.
- Catalin Cimpanu
- January 05, 2018
- 03:00 AM
- 0
Hackers Can Steal Windows Login Credentials Without User Interaction

Microsoft has patched only recent versions Windows against a dangerous hack that could allow attackers to steal Windows NTLM password hashes without any user interaction.
- Catalin Cimpanu
- October 27, 2017
- 02:58 PM
- 5
NTLM Relay Attacks Still Causing Problems in 2017

Microsoft's July 2017 Patch Tuesday includes a fix for an issue with the NT LAN Manager (NTLM) Authentication Protocol that can be exploited to allow attackers to create admin accounts on a local network's domain controller (DC).
- Catalin Cimpanu
- July 11, 2017
- 04:17 PM
- 0