Hackers Swipe Windows NTLM Hashes in Phishing Schemes

What’s going on here?

Hackers, particularly from the group TA577, are executing phishing attacks to steal Windows NT LAN Manager (NTLM) authentication hashes. By manipulating phishing emails, they trick recipients into connecting their Windows devices to an attacker-controlled server, which then collects NTLM hashes. These hashes serve as a key for attackers, as they can be used to authenticate to services without needing the actual passwords, potentially leading to account hijacks, privileged access, or further malicious activity within a network. NTLM hashes’ theft can have profound implications, especially if multi-factor authentication is not in use or if the attacker aims to use gathered information for reconnaissance to identify valuable targets.

What does this mean?

The theft of NTLM hashes through phishing implies a significant security risk for organizations worldwide. It means that without robust security measures and awareness, employees can inadvertently grant attackers access to sensitive company resources. Since the NTLM hashes can be used directly or cracked to reveal a user’s plaintext password, attackers might escalate privileges, access sensitive data, or move laterally within an organization’s network. This campaign underlines a shift in tactics for TA577, focusing on NTLM hash theft rather than deploying malware like Pikabot, indicating a strategic adaptation to target Windows authentication mechanisms specifically.

Why should I care?

Any organization or individual using Windows is at potential risk, especially if current security patches and best practices for email security are not applied. The method of delivering malicious HTML files via phishing emails to steal NTLM hashes represents a clever way to bypass existing security measures, like patched Outlook mail clients, and highlights the importance of staying vigilant about email security. The successful execution of such attacks can lead to significant security breaches, data loss, or even ransomware attacks. Therefore, it is crucial for users to be cautious of unexpected emails, particularly those with attachments or links, and for organizations to enforce strong security policies, including the use of multi-factor authentication wherever possible, to mitigate the risk posed by such phishing campaigns.

For more information, check out the original article here.