Hackers Target NTLM Hashes to Breach Security

A recent shift in cybercriminal tactics has put the spotlight on a sophisticated phishing campaign. The group known as TA577 is now targeting NTLM authentication hashes, exploiting a critical component of Windows security.

The New Cyber Threat Landscape

Previously known for their affiliation with malware like Qbot and ransomware like Black Basta, TA577 has taken a new route. “Proofpoint typically observes TA577 conducting attacks to deliver malware and has never observed this threat actor demonstrating the attack chain used to steal NTLM credentials first observed on February 26,” stated the email security firm Proofpoint.

How the Attack Unfolds

Victims receive phishing emails that cleverly appear as part of an ongoing conversation. These emails contain ZIP archives with unique HTML files for each target, leading to an external SMB server controlled by the attackers.

This server captures the NTLM hashes when the Windows device attempts to connect.

Signs of a Phishing Email Targeting NTLM Hashes

1. Emails appearing as part of an ongoing thread.
2. Attachments containing ZIP archives with HTML files.
3. Requests to open or download files from unknown sources.

The Implications of Stolen NTLM Hashes

The theft of these hashes can have far-reaching consequences. They allow cybercriminals to perform account hijacks, access sensitive data, and move undetected within an organization’s network.

Mitigating the Threat

To combat this growing threat, experts recommend several strategies.

Blocking outbound SMB connections and implementing email filtering against zipped HTML files are among the top suggestions.

Additionally, configuring specific Windows group policies can prevent the outbound flow of NTLM hashes, though this may cause authentication challenges with legitimate servers.

Preventive Measures Against NTLM Hash Theft

1. Block outbound SMB connections.
2. Implement email filtering for zipped HTML files.
3. Configure ‘Restrict NTLM: Outgoing NTLM traffic to remote servers’ policy.
4. Regularly update and patch email clients and systems.

Conclusion

The rise of phishing campaigns targeting NTLM hashes underscores a significant evolution in cyber threats. Organizations must stay vigilant and adopt robust security measures to protect against these sophisticated attacks.

Poll

Have you implemented any specific security measures to protect against NTLM hash theft?

• Yes, we’ve taken multiple precautions.
• No, but we’re planning to.
• Unsure of what measures to take.