Loading story…
Microsoft has announced it will disable the legacy RC4 cryptographic cipher by default in Windows Kerberos authentication, marking a significant move to strengthen enterprise and government network security. The change, set to roll out in stages and be fully enforced by mid-2026, will require domain controllers on Windows Server 2008 and later to use stronger AES-SHA1 encryption by default. RC4 will only be permitted if explicitly configured by a domain administrator, addressing longstanding concerns about the cipher's vulnerabilities and its persistence due to legacy system dependencies.
Security experts have highlighted that RC4's continued use has enabled numerous attacks, including high-profile breaches such as the compromise of health giant Ascension, which exposed millions of patient records. The decision to deprecate RC4 follows mounting criticism, including calls from US lawmakers for regulatory scrutiny over Microsoft's default support for the outdated cipher. The move is widely regarded as one of Microsoft's most significant cryptographic cleanups in years, forcing organizations to modernize authentication systems and reduce exposure to attacks like Kerberoasting that exploit RC4 weaknesses.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft said the Kerberos update will reach domain controller defaults by mid-2026, so that only AES-SHA1 is allowed unless RC4 is explicitly configured. Organizations are being urged to identify and remediate legacy dependencies before the rollout takes effect.
Microsoft announced in December 2025 that it will deprecate RC4 in Windows Kerberos and disable it by default on Windows Server 2008 and later. The change is part of a phased rollout intended to push organizations toward stronger AES-SHA1 encryption while still allowing administrators to re-enable RC4 in limited cases.
In 2023, attackers exploited RC4-related weaknesses in Active Directory during the breach of Ascension, contributing to the compromise of millions of patient records and disruption of hospital operations. The incident became a prominent example of the risks posed by RC4 remaining enabled by default.
The RC4 stream cipher, originally developed by Ron Rivest in 1987, was leaked in 1994, after which its security weaknesses became widely known. Despite this, it continued to see broad use in Windows, SSL/TLS, and Kerberos environments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
wired.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcearstechnica.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft announced a **three-phase roadmap** to reduce reliance on the legacy **NTLM** authentication protocol and ultimately **disable NTLM by default** in a future Windows release, pushing enterprises toward **Kerberos-based** authentication. The change is driven by NTLM’s long-documented weaknesses and exposure to common enterprise attack techniques including **NTLM relay**, **replay**, and **pass-the-hash**, which can enable unauthorized access to network resources when NTLM is used as a fallback. The plan starts with **Phase 1 (available now)** focused on *visibility and control* via enhanced **NTLM auditing** to identify where NTLM is still in use. **Phase 2 (targeted for the second half of 2026 / pre-release features)** aims to reduce NTLM usage by removing migration blockers and improving Kerberos behavior in scenarios that currently fall back to NTLM (including mechanisms such as **IAKerb** and a **local KDC**, and updates to Windows components to prioritize Kerberos). **Phase 3** will **turn NTLM off by default** while keeping it present in the OS for **backward compatibility**, allowing organizations to re-enable it via policy for legacy or NTLM-only dependencies during transition.
Jun 29, 2026
Microsoft announced it will **disable NTLM by default** in future Windows releases, accelerating the retirement of the 30-year-old authentication protocol in favor of more secure, modern alternatives such as **Kerberos** and phishing-resistant, passwordless methods. NTLM remains widely used as a fallback when Kerberos is unavailable, but it relies on weak cryptography and is frequently abused for **NTLM relay** and **pass-the-hash** activity that can enable privilege escalation and domain compromise; the announcement highlights long-standing exploitation paths and coercion techniques associated with relay scenarios (e.g., *PetitPotam*, *ShadowCoerce*, *DFSCoerce*, *RemotePotato0*). Separately, Microsoft is moving Exchange Online toward **deprecating SMTP AUTH Basic Authentication** for all tenants, citing persistent abuse of basic-auth SMTP for **password spraying/brute force** and subsequent account takeover used to send phishing and spam. The change targets legacy workflows (devices, scripts, and third-party tools) that keep basic auth enabled and often bypass modern controls like **MFA** and **Conditional Access**; the referenced timeline indicates SMTP AUTH Basic Authentication remains available until **December 2026** to allow organizations to identify dependencies and migrate to stronger authentication methods.
Jun 29, 2026
Attackers are increasingly leveraging advanced credential theft techniques to compromise Microsoft-based environments, with a focus on identity-first intrusions and abuse of authentication protocols. Kerberoasting attacks have resurged, exploiting legacy RC4 encryption in Kerberos to crack service account passwords, as seen in the Ascension Health ransomware incident. These attacks are facilitated by weak password policies and the continued use of outdated encryption, allowing threat actors to obtain domain administrator credentials and move laterally within networks. The prevalence of credential-based intrusions is underscored by threat intelligence reports indicating that identity attacks are now the leading entry point for breaches. Simultaneously, authentication coercion attacks are evolving, enabling adversaries to force Windows systems to authenticate to attacker-controlled infrastructure without user interaction. Techniques such as exploiting rarely monitored RPC interfaces and tools like PetitPotam (CVE-2021-36942) have been observed in real-world incidents, targeting critical assets like Domain Controllers. Additionally, threat actors are abusing OAuth consent, device code flow, and service principal credential manipulation to maintain persistent, stealthy access to cloud and SaaS platforms, often pivoting from on-premises exploits to Microsoft 365 environments. Organizations are advised to implement robust monitoring, enforce strong authentication policies, and phase out legacy protocols to mitigate these threats.
Jun 29, 2026