CVE-2025-24054, NTLM Exploit in the Wild

This report details the active exploitation of CVE-2025-24054—an NTLM hash disclosure vulnerability triggered by crafted .library-ms (and related) files—which has been observed in malspam campaigns since March 2025 targeting government and private organizations (notably in Poland and Romania). The campaigns leak NTLMv2-SSP hashes to remote SMB servers (several IPs provided), enabling offline cracking, relays, lateral movement, and potential domain compromise; the report includes IOCs (file hashes, IP addresses, email senders) and notes similarities to prior CVE-2024-43451 activity.