Multiple Groups Exploit NTLM Flaw in Microsoft Windows

Researchers observed multiple active campaigns exploiting CVE-2025-24054, an NTLM hash-disclosure vulnerability patched by Microsoft in March; attackers deliver ZIP archives with a malicious library-ms file that triggers Windows to send NTLM authentication to attacker-controlled SMB servers, enabling harvesting of NTLM hashes. Check Point reported attacks starting eight days after the patch, targeting government and private organizations across several countries and finding related SMB infrastructure in Australia, Bulgaria, the Netherlands, Russia, and Turkey. The exploit requires minimal user interaction (e.g., extracting or navigating to a folder) and is used to facilitate pass-the-hash and relay-style credential misuse, underscoring the need for immediate patching and NTLM mitigation.