Old tech, new vulnerabilities: NTLM abuse, ongoing exploitation in 2025

The article discusses the ongoing vulnerabilities and exploitation of the NTLM (New Technology LAN Manager) authentication protocol in 2025. Despite being a legacy system with known weaknesses, NTLM is still widely used in Windows environments, making it a target for cybercriminals. Key points include:

1. **Historical Context**: NTLM has been around since the early 2000s, and its weaknesses have been exploited for over two decades. Microsoft plans to phase it out, but it remains prevalent due to compatibility issues.

2. **Authentication Process**: NTLM uses a challenge-response mechanism for authentication, which is vulnerable to various attacks.

3. **Current Threats**: The article outlines persistent threats such as hash leakage, coercion-based attacks, credential forwarding, and Man-in-the-Middle (MitM) attacks that exploit NTLM's design flaws.

4. **Recent Vulnerabilities**: Several CVEs (Common Vulnerabilities and Exposures) have been identified, including CVE-2024-43451, which allows attackers to leak NTLMv2 hashes with minimal user interaction, and CVE-2025-24054, which exploits crafted files to initiate NTLM authentication requests.

5. **Attack Campaigns**: Notable campaigns like BlindEagle and Head Mare have utilized these vulnerabilities to distribute malware and conduct espionage.

6. **Protection Recommendations**: The article suggests disabling or limiting NTLM, implementing message signing, enabling Extended Protection for Authentication (EPA), and monitoring NTLM traffic to mitigate risks.

7. **Conclusion**: NTLM remains a significant security liability, and organizations must take proactive measures to phase it out and adopt more secure authentication methods.