Microsoft’s latest update shows that, by exploiting a vulnerability (CVE-2024-21410), attackers are able to carry out a so-called NTLM relay attack, also known as “Pass the Hash”. NTLM is a set of security protocols that authenticate the identity of users and the confidentiality of their activities.
Threat actors target programs like Outlook that have a vulnerability to spy on NTLM credentials. The program is tricked into authenticating itself to a fake server that they control. Once the credentials are exposed, they can be used for malicious purposes.
What is NTLM exactly?
NTLM stands for New Technology LAN Manager. This is a set of security protocols that authenticate the identity of users and the confidentiality of their activities (CrowdStrike). By using this authentication method, single sign-on on web servers or proxy servers is possible using the credentials of the Windows user login (Wikipedia).
What should you do?
The security of your organization’s Exchange server environment is paramount. Act quickly to protect against potential threats and ensure uninterrupted operations.
We will be happy to answer any questions you may have.
