Zombie Protocol: How NTLM Flaws Like CVE-2024-43451 Are Haunting 2025

A Kaspersky Labs report highlights the ongoing security risks associated with the NTLM authentication protocol in 2025, despite its age. Cybercriminals are exploiting vulnerabilities, particularly CVE-2024-43451, which allows attackers to steal NTLMv2 hashes with minimal user interaction. The report identifies specific threat actors, including BlindEagle and Head Mare, who have weaponized these flaws for attacks. A notable vulnerability, CVE-2025-33073, enables internal attackers to gain SYSTEM-level privileges. Kaspersky urges organizations to transition to Kerberos and audit NTLM traffic to mitigate these risks.