Loading story…
Sophos published a CPU-based method and released the v1-nightshift tool to accelerate recovery of NetNTLMv1 credentials from captured challenge-response data, reducing lookups that previously consumed GPUs for up to eight hours to under 20 minutes on a single 64-core EPYC server. The approach uses bitsliced DES with AVX2, removes repeated DES key-schedule generation, and splits processing into precompute, search, and check phases, with a separate brute-force step for the low-entropy third NetNTLMv1 block. Sophos said the design reaches roughly 2.1 billion DES operations per second and can scale across multiple CPU servers without requiring dedicated GPUs.
The work builds on Mandiant's public release of Net-NTLMv1 DES rainbow tables, which was intended to demonstrate the protocol's long-known weakness and push organizations to retire it. Mandiant warned that when Net-NTLMv1 is used without ESS and a known challenge can be obtained, attackers can recover NTLM hash material tied to Active Directory user or computer accounts, enabling privilege escalation after coerced authentications captured with tools such as Responder, PetitPotam, or DFSCoerce. Together, the table release and Sophos's faster CPU-only lookup workflow further lower the cost of exploiting legacy NetNTLMv1, reinforcing the need to disable the protocol and close authentication-coercion paths.
Get the actors, campaigns, and ATT&CK mapping behind it.
10 events from the most recent confirmed update back to the earliest known activity.
Mandiant publicly released a comprehensive Net-NTLMv1 rainbow-table dataset to demonstrate the protocol's insecurity and accelerate migration away from it.
Hashcat added support for cracking DES keys using known plaintext, which Mandiant cited as increasing the practicality of attacking Net-NTLMv1.
Mandiant noted that Net-NTLMv1 insecurity was widely discussed by at least 2012, including presentations at DEFCON 20.
Philippe Oechslin described rainbow tables in a 2003 paper, providing the lookup approach later applied to Net-NTLMv1 DES key recovery.
Mandiant said Net-NTLMv1 had been known to be insecure for over two decades, with relevant cryptanalysis dating back to at least 1999.
Martin Hellman described the time-memory trade-off concept that later underpinned rainbow-table techniques referenced in the Net-NTLMv1 story.
Sophos reported that the optimized workflow reduced a NetNTLMv1 downgrade lookup from up to eight hours on GPUs to under 20 minutes on a single server, with faster runtimes on small clusters.
Sophos described a CPU-based approach using bitsliced DES, AVX2, and key-schedule elimination to accelerate NetNTLMv1 rainbow-table lookups without GPUs.
Mandiant published guidance for downloading the Net-NTLMv1 tables from Google Cloud Storage, verifying SHA-512 checksums, and using the data with existing lookup tools.
Sophos published v1-nightshift, a CPU-only NetNTLMv1 rainbow-table lookup toolset built for Mandiant's tables and supporting single-machine and distributed workflows.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
sophos.com
Open sourcesophos.com
Open sourcecloud.google.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google-owned **Mandiant** released a public dataset of **Net-NTLMv1 rainbow tables** intended to make the long-known weakness of Microsoft’s legacy Net-NTLMv1 authentication protocol easy to demonstrate and harder to ignore. Mandiant stated the dataset enables defenders and researchers to recover Net-NTLMv1 key material in **under ~12 hours** using **consumer hardware costing under ~$600**, significantly lowering the barrier to proving real-world credential exposure. The release is positioned as a push to accelerate retirement of Net-NTLMv1, which has been considered cryptographically broken for decades yet is still observed in active enterprise environments. The practical risk highlighted is that once an attacker captures a **Net-NTLMv1 hash** (notably in scenarios lacking **Extended Session Security (ESS)** and involving a known plaintext value such as `1122334455667788`), they can apply known-plaintext techniques to recover key material equivalent to the password hash for the authenticating Active Directory object. Reporting also notes common attack paths that can precede hash capture, including **authentication coercion** against privileged systems (e.g., domain controllers) using tools such as *PetitPotam* or *DFSCoerce*. Mandiant’s guidance is explicit: organizations should **immediately disable Net-NTLMv1** and migrate away from the protocol to reduce credential-theft and lateral-movement risk.
Jun 29, 2026
Microsoft disclosed **CVE-2024-38200**, a vulnerability in **Microsoft Office 2016**, **Office 2019**, **Office LTSC 2021**, and **Microsoft 365 Apps** that can let a remote, unauthenticated attacker exfiltrate **NTLM** hashes used for authentication. The issue requires user interaction, such as opening a specially crafted file or clicking a malicious URL, and was assigned a **CVSS 7.5** severity score. Researchers from **PrivSec Consulting** identified the flaw and planned to present additional details at **DEF CON**. Microsoft said mitigations were rolled out through **Feature Flighting** for supported Office and Microsoft 365 versions and urged customers to install the August security updates. The company also recommended hardening steps to reduce NTLM exposure, including using the **Protected Users** security group in Windows Server to limit legacy authentication protections, blocking outbound NTLM communication where possible, and restricting outbound **TCP 445/SMB** traffic to prevent credential leakage.
Jul 24, 2026
Researchers reported that **CVE-2025-59214** is a zero-click Windows NTLM credential-leakage flaw that bypasses prior mitigations for **CVE-2025-24054** and **CVE-2025-50154**. A crafted shortcut can cause Windows Explorer to automatically authenticate to an attacker-controlled UNC/SMB endpoint, disclosing an NTLMv2-SSP hash without requiring victim interaction; the issue was reportedly reproduced on a fully updated Windows Server 2022 system with `KB5063880` installed. The leak stems from inconsistent validation of shortcut fields: Explorer checks icon paths but can process a UNC target path through an alternate existence-check path that initiates NTLM authentication. Attackers could crack captured hashes offline or relay them to other services, creating paths to unauthorized access, privilege escalation, lateral movement, or remote code execution depending on the exposed account and environment. Earlier reporting documented exploitation of CVE-2025-24054 in the wild, underscoring the operational risk of NTLM coercion through malicious Windows shortcut content.
Sep 3, 2026