Loading story…
New research has shown that password material from two widely used enterprise platforms can be transformed into formats suitable for offline cracking tools. A Silent Signal analysis of IBM i found that the QSYRUPWD API can be reverse engineered to recover reusable verifier data, including DES-derived values, SHA-1-related values, and NT hashes, even on systems using QPWDLVL 4. The author reported that exploiting the issue requires highly privileged *ALLOBJ and *SECADM authorities, but warned that anyone holding both permissions can extract credential material without knowing or resetting users’ passwords.
A separate Pentagrid study detailed how modern ASP.NET Core Identity password hashes can be correctly parsed into Hashcat-compatible input, including configurable v3 hashes that vary by PRF, iteration count, salt length, and subkey length. The researchers said many existing converters fail because they assume default parameters, while their approach supports v2 and v3 hashes using PBKDF2-HMAC-SHA1, SHA256, and SHA512. Supporting Hashcat documentation and example hash references underscore that once credential data is converted into recognized formats, organizations face increased password-auditing and password-cracking exposure if hashes are leaked or exported.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Silent Signal published analysis concluding that IBM i QSYRUPWD output can be reverse engineered into offline-crackable credential material on systems using QPWDLVL 2 and even QPWDLVL 4. The research showed that highly privileged administrators with *ALLOBJ and *SECADM can recover reusable verifier material, including NT hashes, from the API output.
Pentagrid published research explaining how to correctly parse ASP.NET Core Identity v2 and v3 password hashes into Hashcat-compatible format, including support for non-default v3 parameters. The article also warned that older Microsoft .NET PBKDF2 defaults may be weaker than OWASP recommendations if hashes are exposed.
The Hashcat wiki published its example hashes reference page, providing sample hash formats used for identification and cracking workflows.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
blog.silentsignal.eu
Open sourcepentagrid.ch
Open sourcehashcat.net
Open sourcehashcat.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft warned that attackers are actively using publicly disclosed ASP.NET `machineKey` values to achieve remote code execution on vulnerable IIS-hosted ASP.NET applications. The attacks abuse exposed static `validationKey` and `decryptionKey` values to generate malicious ViewState payloads with valid message authentication codes, allowing the ASP.NET runtime to accept and execute attacker-controlled data. Microsoft said the activity has been observed since at least December 2024 and linked some intrusions to deployment of the **Godzilla** post-exploitation framework. The company identified more than 3,000 leaked keys and released their hashes in a CSV file so organizations can check whether their environments are exposed. Guidance from Microsoft and CSIRT.SK urges defenders to replace any public or default keys, protect sensitive `web.config` elements through encryption, upgrade ASP.NET to at least version **4.8**, and further harden Windows and IIS servers to reduce the risk of malware deployment and follow-on compromise.
Jul 24, 2026
Google-owned **Mandiant** released a public dataset of **Net-NTLMv1 rainbow tables** intended to make the long-known weakness of Microsoft’s legacy Net-NTLMv1 authentication protocol easy to demonstrate and harder to ignore. Mandiant stated the dataset enables defenders and researchers to recover Net-NTLMv1 key material in **under ~12 hours** using **consumer hardware costing under ~$600**, significantly lowering the barrier to proving real-world credential exposure. The release is positioned as a push to accelerate retirement of Net-NTLMv1, which has been considered cryptographically broken for decades yet is still observed in active enterprise environments. The practical risk highlighted is that once an attacker captures a **Net-NTLMv1 hash** (notably in scenarios lacking **Extended Session Security (ESS)** and involving a known plaintext value such as `1122334455667788`), they can apply known-plaintext techniques to recover key material equivalent to the password hash for the authenticating Active Directory object. Reporting also notes common attack paths that can precede hash capture, including **authentication coercion** against privileged systems (e.g., domain controllers) using tools such as *PetitPotam* or *DFSCoerce*. Mandiant’s guidance is explicit: organizations should **immediately disable Net-NTLMv1** and migrate away from the protocol to reduce credential-theft and lateral-movement risk.
Jun 29, 2026
Recent research highlights the persistent risk posed by weak passwords, with modern password cracking tools able to compromise a significant portion of real-world credentials in under an hour. Analysis of over 190 million passwords reveals that nearly 60% can be cracked within sixty minutes, largely due to the power of contemporary GPUs and advanced brute-force and dictionary attack techniques. Security experts emphasize the importance of adopting stronger authentication strategies, such as using passphrases and password managers, to mitigate these risks and prevent unauthorized access to sensitive systems and data. Longitudinal studies of leaked password datasets from 2007 to 2025 show that user habits and password strength have improved over time, particularly following major breach events and the introduction of stricter password policies. The adoption of machine-generated passwords and built-in password managers in operating systems has contributed to measurable progress, though a minority of users still rely on weak, easily guessed credentials. Security professionals recommend continued education and the implementation of advanced password management tools to address remaining gaps and further strengthen enterprise security posture.
Jun 29, 2026