Old tech, new vulnerabilities: NTLM abuse, ongoing exploitation in 2025

MITRE Techniques

• [T1557.001 ] LLMNR/NBT-NS Poisoning and SMB Relay – NTLM relay and reflection attacks are used to intercept or coerce authentication; (‘NTLM relay remains the most enduring and impactful method… tools include Responder, Impacket’s NTLMRelayX, and Inveigh’)
• [T1550.002 ] Pass the Hash – Captured NTLMv2 hashes are reused to impersonate users and access remote systems; (‘they can execute a pass-the-hash attack (e.g. by using tools like WMIExec or PSExec) to gain network access by impersonating a valid user’)
• [T1566.001 ] Spearphishing Attachment – Phishing emails deliver .url or ZIP attachments that trigger NTLM authentication and payload retrieval; (‘These files were delivered through phishing emails impersonating Colombian government and judicial entities’)
• [T1204.002 ] User Execution: Malicious File – Minimal interactions (preview, single-click, right-click, move) with crafted .url/.library-ms files trigger automatic authentication and sometimes automatic download/execution; (‘a minimal interaction with the malicious file, such as a single click or a right click, triggers automatic connection to the server, file download, and execution’)
• [T1134 ] Access Token Manipulation – NTLM reflection/local relay is used to coerce a host into authenticating to itself and obtain a SYSTEM token for privilege escalation; (‘an attacker can trick the system into believing the authentication request originates from the same host… the injected token is handled as if it were trusted’)
• [T1003.001 ] Credential Dumping: LSASS Memory – Attackers dump LSASS memory using comsvcs.dll, custom DLLs, or PowerShell to extract credentials post-compromise; (‘…invokes an internal function of comsvcs.dll to dump LSASS memory and save it’ and ‘The script leverages MiniDumpWriteDump via reflection’)
• [T1543.003 ] Create or Modify System Process: Windows Service – Persistence is established by creating service entries in the registry after escalation; (‘Persistence was then established by creating a suspicious service entry in the registry under: reg:REGISTRYMACHINESYSTEMControlSet001ServicesYlHXQbXO’)
• [T1021.002 ] Remote Services: SMB/Windows Admin Shares – Lateral movement attempts use administrative shares and remote-execution tools (PsExec, SMBExec) to move across hosts; (‘the attacker attempted lateral movement by writing to the administrative share of another host’)
• [T1021.006 ] Remote Services: WMI – Tools like wmiexec.py are used to execute commands or move laterally using WMI-based remote execution; (‘tools like Mimikatz allow extraction and injection of NTLM hashes… Impacket’s wmiexec.py, PsExec.py, and secretsdump.py can be used to perform remote execution’)
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – Base64-encoded PowerShell was used to run reflective minidump routines to dump process memory; (‘The script leverages MiniDumpWriteDump via reflection. It uses the Out-Minidump function that writes a process dump with all process memory to disk’)