TA577 Hackers Attacking Hundreds of Organizations to Steal NTLM Hashes

**TA577 campaign summary:** TA577 conducted large-scale phishing campaigns using thread-hijacked emails with zipped HTML attachments that pointed victims to external SMB shares via file:// URLs; the attackers captured NTLMv2 challenge/response pairs (for password cracking or pass‑the‑hash) and leveraged Impacket on SMB servers, delivered Pikabot as an initial payload, and targeted organizations worldwide—IOCs and detection rules are provided with recommendations to block outbound SMB and harden environments.