A freshly discovered NTLM vulnerability in Windows is being exploited only a week after Microsoft patched the issue. The vulnerability is tracked as CVE-2025-24054 and has a CVSS score of 6.5. If exploited correctly, this medium-severity flaw can allow hackers to access your NTLM hash, enabling them to carry out spoofing attacks over the network.
NTLM, or New Technology LAN Manager, is a suite of authentication protocols developed by Microsoft to verify user credentials and protect networks. If an attacker gains access to the NTLM hash, they can brute-force it offline or carry out relay attacks to obtain a victim’s network credentials.
Microsoft’s advisory warns that exploitation only requires minimal user interaction. Even selecting, dragging, or right-clicking the file can trigger an exploit. Post exploitation, attackers can move laterally on the network, elevate their privileges, and even compromise the domain. However, this largely depends on the privileges of the compromised user, meaning a compromised admin account can cause more damage than a simple network user.
As for the threat actors behind the exploit, security researchers from Check Point Research found hackers exploiting the bug in attacks targeting Polish and Romanian government and private organisations. The campaign appears to have occurred between March 20 and 21. Victims were targeted via phishing links sent to their emails, which included a link to an archive download from Dropbox.
This isn’t the only campaign targeting the vulnerability, either. Until March 25, researchers found another 10 campaigns attempting to capture NTLM hashes from targets, with the attacking servers hosted in Australia, Bulgaria, the Netherlands, Russia, and Turkey.
Microsoft’s advisory claims that CVE-2025-24054 hasn’t been exploited in the wild yet. However, in addition to Check Point Research’s observation, the US CISA has also added the bug to its list of Known Exploited Vulnerabilities, mandating that all federal agencies patch the issue by May 8.
In the News: Indian consumer courts to accept complaints against WhatsApp
