Loading story…
Google-owned Mandiant released a public dataset of Net-NTLMv1 rainbow tables intended to make the long-known weakness of Microsoft’s legacy Net-NTLMv1 authentication protocol easy to demonstrate and harder to ignore. Mandiant stated the dataset enables defenders and researchers to recover Net-NTLMv1 key material in under ~12 hours using consumer hardware costing under ~$600, significantly lowering the barrier to proving real-world credential exposure. The release is positioned as a push to accelerate retirement of Net-NTLMv1, which has been considered cryptographically broken for decades yet is still observed in active enterprise environments.
The practical risk highlighted is that once an attacker captures a Net-NTLMv1 hash (notably in scenarios lacking Extended Session Security (ESS) and involving a known plaintext value such as 1122334455667788), they can apply known-plaintext techniques to recover key material equivalent to the password hash for the authenticating Active Directory object. Reporting also notes common attack paths that can precede hash capture, including authentication coercion against privileged systems (e.g., domain controllers) using tools such as PetitPotam or DFSCoerce. Mandiant’s guidance is explicit: organizations should immediately disable Net-NTLMv1 and migrate away from the protocol to reduce credential-theft and lateral-movement risk.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Mandiant recommended immediate mitigation by disabling NTLMv1 and enforcing NTLMv2-only settings through Group Policy, while warning that local settings can be downgraded after compromise. The guidance also pointed defenders to monitoring opportunities such as Windows Event ID 4624 to detect NTLMv1 use.
With the release, Mandiant highlighted that captured Net-NTLMv1 challenge-response material can be used to recover keys in under 12 hours using less than $600 of consumer hardware, substantially lowering the cost and complexity of credential recovery. The material also described how this could enable privilege escalation, including recovery of domain controller machine account hashes and DCSync against Active Directory.
Mandiant publicly released a comprehensive, downloadable dataset of Net-NTLMv1 rainbow tables, along with documentation and workflow guidance for common cracking tools. The release was intended to help defenders demonstrate the risk of the legacy protocol and accelerate its retirement.
The references state that Net-NTLMv1 has been cryptographically broken since 1999 and has long been recognized as insecure, yet it is still present in some enterprise environments. This longstanding weakness set the stage for later efforts to force its retirement.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecsoonline.com
Open sourcego.theregister.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos published a CPU-based method and released the `v1-nightshift` tool to accelerate recovery of NetNTLMv1 credentials from captured challenge-response data, reducing lookups that previously consumed GPUs for up to eight hours to **under 20 minutes** on a single 64-core EPYC server. The approach uses bitsliced DES with AVX2, removes repeated DES key-schedule generation, and splits processing into **precompute**, **search**, and **check** phases, with a separate brute-force step for the low-entropy third NetNTLMv1 block. Sophos said the design reaches roughly **2.1 billion DES operations per second** and can scale across multiple CPU servers without requiring dedicated GPUs. The work builds on Mandiant's public release of Net-NTLMv1 DES rainbow tables, which was intended to demonstrate the protocol's long-known weakness and push organizations to retire it. Mandiant warned that when Net-NTLMv1 is used without ESS and a known challenge can be obtained, attackers can recover NTLM hash material tied to Active Directory user or computer accounts, enabling privilege escalation after coerced authentications captured with tools such as Responder, PetitPotam, or DFSCoerce. Together, the table release and Sophos's faster CPU-only lookup workflow further lower the cost of exploiting **legacy NetNTLMv1**, reinforcing the need to disable the protocol and close authentication-coercion paths.
Aug 17, 2026
Microsoft disclosed **CVE-2024-38200**, a vulnerability in **Microsoft Office 2016**, **Office 2019**, **Office LTSC 2021**, and **Microsoft 365 Apps** that can let a remote, unauthenticated attacker exfiltrate **NTLM** hashes used for authentication. The issue requires user interaction, such as opening a specially crafted file or clicking a malicious URL, and was assigned a **CVSS 7.5** severity score. Researchers from **PrivSec Consulting** identified the flaw and planned to present additional details at **DEF CON**. Microsoft said mitigations were rolled out through **Feature Flighting** for supported Office and Microsoft 365 versions and urged customers to install the August security updates. The company also recommended hardening steps to reduce NTLM exposure, including using the **Protected Users** security group in Windows Server to limit legacy authentication protections, blocking outbound NTLM communication where possible, and restricting outbound **TCP 445/SMB** traffic to prevent credential leakage.
Jul 24, 2026
Security researchers have highlighted ongoing exploitation and new vulnerabilities in the NTLM authentication protocol, which remains widely used in enterprise environments despite its well-known weaknesses. Recent research details multiple attack vectors, including hash leakage, coercion-based attacks, credential forwarding, and man-in-the-middle (MitM) techniques, as well as the continued use of NTLM in modern operating systems and legacy applications. Notable campaigns in 2025 have leveraged vulnerabilities such as CVE-2024-43451, CVE-2025-24054, and CVE-2025-33073 to deliver malware and conduct targeted attacks, particularly in Russia and Uzbekistan. Proof-of-concept exploits for NTLM elevation of privilege vulnerabilities have been released, further increasing the risk to organizations that have not yet migrated away from NTLM or implemented robust mitigations. Security experts recommend disabling or limiting NTLM, enabling message signing, and monitoring authentication logs to reduce exposure. The persistence of NTLM in critical infrastructure underscores the urgent need for organizations to transition to more secure authentication protocols and to remain vigilant against evolving exploitation techniques targeting NTLM weaknesses.
Jun 29, 2026