Windows NTLM vulnerability exploited in multiple attack campaigns (CVE-2025-24054)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-43451 | NTLMv2 Hash Disclosure Spoofing Vulnerability in Microsoft Windows CVE-2024-43451 is a flaw in the NTLM authentication implementation of Microsoft Windows that lets an attacker obtain a user's NTLMv2 authentication hash. It requires user interaction: a victim who engages with attacker-supplied content, such as a crafted file or an attacker-controlled file path/URL reference (consistent with the CWE-73 external control of file name weakness), causes Windows to silently initiate an NTLM authentication to a hostile host, leaking the hash. An attacker who captures the hash can crack it offline to recover the user's password or relay it to authenticate (spoof) as that user to other services, enabling credential theft and lateral movement. Any unpatched installation of the listed Windows 10, Windows 11, and Windows Server 2008/2012/2016/2019 versions is exposed, which covers essentially every mainstream Windows estate current in late 2024. Exploitation is confirmed: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-11-12, researchers have reported Russian-linked attackers using it in phishing campaigns delivering RAT malware, and EPSS assigns an 84.1% probability of exploitation within 30 days, though no public proof-of-concept code is known. Do: Apply Microsoft's November 2024 Patch Tuesday security updates (or later cumulative updates) to all listed Windows 10/11 client and Windows Server versions; the KEV listing makes patching mandatory for US federal agencies. As interim mitigation, block outbound SMB/HTTP NTLM authentication to untrusted destinations (e.g., firewall outbound TCP 445 from endpoints) and, where feasible, restrict NTLM in favor of Kerberos via Group Policy. Hunt for phishing emails containing crafted files and for unexpected outbound authentication attempts from workstations, and rotate credentials for accounts that may have authenticated to untrusted hosts before patching. | 6.5 | 84% | KEV |
| masshundreds of millions of Windows 10/11 endpoints and Windows Server 2008-2019 instances worldwide | |
| CVE-2025-24054 | NTLM Hash Disclosure Spoofing Vulnerability in Microsoft Windows CVE-2025-24054 is a spoofing vulnerability in Microsoft Windows NTLM caused by external control of a file name or path (CWE-73): when Windows processes a file whose name or path points to an attacker-controlled resource, the system is induced to authenticate via NTLM to that destination, disclosing the user's NTLM hash. An unauthorized network attacker triggers the flaw by convincing a user to interact with a crafted file, for example downloading or opening a malicious file, which sends NTLM credentials to a host of the attacker's choosing. With the captured NTLM hash, the attacker can attempt relay or offline cracking to spoof and impersonate the user on the network; no privileges are required, but user interaction is needed (CVSS 3.1: 5.4, medium). Any unpatched Windows 10 (1507 through 22H2), Windows 11 (22H2 through 24H2), or Windows Server 2008, 2012, 2016, or 2019 system in environments that use NTLM authentication is affected. The flaw is being actively exploited: CISA added it to the KEV catalog on 2025-04-17, EPSS puts the 30-day exploitation probability at about 59% (99th percentile), public proof-of-concept exploits exist, and multiple attack campaigns have been reported, including targeting of organizations in Poland and Romania shortly after the patch became available. Do: Apply Microsoft's April 2025 security updates across all listed Windows 10, Windows 11, and Windows Server releases and confirm updated builds through patch-management reporting; the flaw was added to CISA's KEV on 2025-04-17, so federal agencies must patch per BOD 22-01 deadlines or apply vendor mitigations. As interim mitigation, restrict outbound NTLM authentication (for example by blocking outbound TCP 445/139 to untrusted hosts, enforcing SMB signing, or removing NTLM where feasible) and hunt for anomalous outbound NTLM authentication following user file downloads or opening of untrusted shortcut files. | 5.4 | 59% | KEV PoC ×3 |
| masshundreds of millions of Windows devices (desktops and servers on the affected Windows 10, Windows 11, and Windows Server releases with NTLM in use) | |
| CVE-2025-24071 | Windows File Explorer Spoofing Vulnerability Exposes Authentication Credentials CVE-2025-24071 is an information-exposure/spoofing flaw (CWE-200) in Windows File Explorer in which Explorer can be induced to send the user's sensitive authentication material - an NTLM credential hash, per the related Windows NTLM reporting - to an attacker-controlled resource over the network. Because the attack vector is network-based but requires user interaction (CVSS AV:N/UI:R, no privileges needed), a typical attack lures a user into viewing or opening a crafted file or remote location in File Explorer, at which point Windows automatically authenticates to the attacker's endpoint. The attacker gains high-value confidential data - the user's credential hash - which can be cracked offline or relayed to spoof/impersonate the user, with no direct integrity or availability impact. Essentially every unpatched Windows deployment is exposed: Windows 10 (1507, 1607, 1809), Windows 11 (23H2, 24H2), and Windows Server 2012 through 2025 all ship File Explorer. The flaw is not yet in CISA KEV and has one public PoC/detection reference, but the sibling Windows NTLM flaw CVE-2025-24054 has already been exploited in the wild in campaigns (including targets in Poland and Romania days after patching) attributed to EncryptHub, and this CVE's EPSS of 24.6% (98th percentile) signals elevated near-term exploitation risk. Do: Apply Microsoft's latest cumulative Windows security updates on all affected Windows 10, Windows 11, and Windows Server hosts - Microsoft fixed this flaw in its March 2025 Patch Tuesday releases - prioritizing servers and user-facing workstations that handle untrusted files. Until patched, block outbound SMB/NTLM to untrusted hosts (e.g., via Windows Defender Firewall) to blunt hash-leak/spoofing attempts and avoid opening or previewing untrusted files and remote locations in File Explorer. Given that the closely related NTLM flaw CVE-2025-24054 was exploited in the wild by the actor Microsoft attributes to EncryptHub soon after patching, monitor for abnormal outbound NTLM/SMB connections and treat this CVE as a likely near-term target. | 6.5 | 23% | PoC ×2 |
| mass~1 billion+ Windows devices (unpatched share of the ~1.4B-device global Windows install base; File Explorer is present on all listed desktop and GUI-based… |
Full article667 words · extracted from helpnetsecurity.com · click to collapse
CVE-2025-24054, a Windows NTLM hash disclosure vulnerability that Microsoft has issued patches for last month, has been leveraged by threat actors in campaigns targeting government and private institutions in Poland and Romania.
“Active exploitation in the wild has been observed since March 19, 2025, potentially allowing attackers to leak NTLM hashes or user passwords and compromise systems,” Check Point researchers have shared.
About CVE-2025-24054
CVE-2025-24054 allows attackers to capture the NTLMv2 response (i.e., the NTLMv2-SSP hash) sent by the victims’ machine to an attacker-operated SMB server that initiated an authentication request.
Attackers can attempt to attempt to brute-force this captured hash offline or can use it to perform relay attacks.
“NTLM relay attacks fall under the category of man-in-the-middle (MitM) attacks that exploit the NTLM authentication protocol. Instead of cracking the password, the attacker captures the hash and passes it to another service to authenticate as the user,” the researchers explained.
“NTLM relay attacks are much more dangerous when the stolen credentials belong to a privileged user, as the attacker is using it for privilege escalation and lateral movement on the network.”
CVE-2025-24054, privately disclosed to Microsoft by three researchers, was considered by the company to be “less likely” to be exploited.
Microsoft had initially assigned CVE-2025-24071 to the vulnerability, but later created a new identifier: CVE-2025-24054. Both were patched on March 11, 2025 and both can allow an unauthorized attacker to perform spoofing over a network, but the former requires the target to open a folder that contains a specially crafted file, while the latter requires them only to interact with (e.g., select, inspect, move) the malicious file, and not necessarily to open and execute it.
In that respect, CVE-2025-24054 is similar to CVE-2024-43451, a vulnerability that was exploited in 2024 as a zero-day to target Ukrainian entities.
The spotted attack campaigns
One of the researchers who initially flagged CVE-2025-24054 released a PoC exploit and a technical write-up on the flaw on March 16 and 18, respectively.
Check Point researchers say that the first attacks leveraging CVE-2025-24054 were spotted on March 19, and that the campaign targeting government and private institutions in Poland and Romania started around March 20 and March 21.
“The campaign consisted of targeted the victims via email phishing links, which include an archive file,” the researchers explained.
“The archive xd.zip was downloaded from Dropbox and contained files with the sole purpose of leaking NTLMV2-SSp hashes. Those four embedded files contacted a malicious SMB server with IP address 159.196.128[.]120.”
One of the files contained in the archive triggered CVE-2025-24054, while another exploited CVE-2024-43451. According to a previous report by HarfangLab researchers, the IP address of the server has been previously linked to APT28, aka Fancy Bear or Forest Blizzard.
Until March 25, Check Point have observed approximately 10 additional campaigns with the end goal of retrieving NTLMV2-SSp hashes from the targeted victims. On that day, they spotted one targeting companies around the world.
The phishing emails were carefully constructed to trick targets into downloading the attachment containing an unzipped exploit file:
Phishing email with exploit file attached (Source: Check Point Research)
“As soon as victims downloaded the exploit, their NTLMV2-SSp hashes were leaked,” the researchers explained.
Fixes for CVE-2025-24054
Even if they are not generally considered to be as high-risk as flaws leading to remote code execution, it’s become obvious that some attackers are ready to take advantage of NTLM vulnerabilities quickly and patches for them should be prioritized – especially because NTLMv2 is still widely used for authentication even though Microsoft has officially deprecated all NTLM versions last year and urged users to switch to Kerberos.
Microsoft has released patches for CVE-2025-24054 for all supported Windows and Windows Server versions, but for those still using older, unsupported versions – e.g., Windows 7, Windows 10 v21H2, Windows Server 2008 R2 and Server 2012 R2 – micropatching is a viable solution.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2025/04/17/windows-ntlm-vulnerability-exploited-in-multiple-attack-campaigns-cve-2025-24054/