[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRYgoMwUbJpShFQ-zyztMSW7QxWrQPXahpJAIOheuF5k":3,"$ftrxv7OxVFAt_bPTwovQ9hhZRZeBOOoD0K3ZaFGSwv64":75},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":72,"created_at":73,"updated_at":74,"published_at":37},"lockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay","LockFile Ransomware Hijacks Windows Domains via PetitPotam NTLM Relay","Gang exploits CVE-2021-36942 on domain controllers after initial access via ProxyShell on Exchange servers.","LockFile ransomware gang is leveraging the PetitPotam NTLM relay attack (CVE-2021-36942) to take over Windows domain controllers, with initial access gained through ProxyShell on Exchange servers.",[10,11,12,13,14,15],"ransomware","PetitPotam","NTLM relay","ProxyShell","LockFile","CVE-2021-36942","# LockFile Ransomware Hijacks Windows Domains via PetitPotam NTLM Relay\n\n*Gang exploits CVE-2021-36942 on domain controllers after initial access via ProxyShell on Exchange servers.*\n\n**Tags:** `ransomware` `PetitPotam` `NTLM relay` `ProxyShell` `LockFile` `CVE-2021-36942`\n\n> LockFile ransomware gang is leveraging the PetitPotam NTLM relay attack (CVE-2021-36942) to take over Windows domain controllers, with initial access gained through ProxyShell on Exchange servers.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2021-36942 | 7.5 | 66.0% | ✅ listed | available | 72.75 (High) |\n\n## LockFile hijacks Windows domains with PetitPotam\n\nLockFile is a new ransomware gang first observed in July 2021, with activity confirmed as of August 20, 2021. The group has been recorded primarily in the U.S. and Asia, hitting organizations across financial services, manufacturing, engineering, legal, business services, travel, and tourism.\n\nThe attack chain begins with ProxyShell on Exchange servers for initial access, then pivots to the domain controller via PetitPotam (CVE-2021-36942). The LSA spoofing flaw forces NTLM relay to a remote server under LockFile’s control, giving the gang full domain control once the DC is taken. The CVE carries a CVSS 7.5, sits in CISA’s KEV list, and has an EPSS score of 66.0% (99th percentile), with a public PoC available.\n\nLockFile relies on publicly available code for the original PetitPotam variant. Once the shellcode executes, it activates `efspotato.exe` to run the exploit, then copies the ransom payload to the DC and pushes it across the network to client hosts after authentication.\n\n## The attack chain: ProxyShell in, PetitPotam out\n\nThe first step is ProxyShell on Exchange. LockFile lands on the mail server to get a foothold, then pivots to the domain controller. The second step is where the domain falls: an encrypted shellcode activates `efspotato.exe`, which runs the PetitPotam exploit against the DC. The LSA spoofing flaw (CVE-2021-36942) forces NTLM relay to a remote server under LockFile’s control, giving the gang full domain control once the DC is taken.\n\nThe final step copies the LockFile payload to the local DC and pushes it across the network to client hosts via a script that runs immediately after authentication. The researchers note the attackers typically sit on the network for several days before detonating the file-encrypting malware, which is typical for this class of ransomware.\n\n## LockBit and Conti connections\n\nSymantec notes the LockFile ransom note is \"very similar\" to the one used by LockBit, a direct stylistic match that suggests shared lineage or deliberate copying. The contact email left for victims is `contact@contipauper[.]com` — a not-so-subtle nod to Conti that the researchers flag as a deliberate reference.\n\nThe email domain choice invites speculation. LockFile looks like the project of a disgruntled Conti affiliate who leaked the gang's attack playbook, per Symantec's read on the naming convention. The researchers believe LockFile is a new actor with ties to known or retired players in the community, though they stop short of naming the specific connection.\n\n## CVE-2021-36942: the LSA spoofing flaw\n\nCVE-2021-36942 is the Windows LSA Spoofing vulnerability, also known as PetitPotam. It carries a CVSS 7.5 (v3.1), sits in CISA’s Known Exploited Vulnerabilities list, and has an EPSS score of 66.0% at the 99th percentile. A public PoC is available.\n\nMicrosoft’s official mitigations and updates do not fully block the attack vector yet. LockFile uses publicly available code for the original PetitPotam variant, which is the one tracked under this CVE.\n\n## Key points\n\n- LockFile uses PetitPotam (CVE-2021-36942) to relay NTLM authentication to a remote server under their control, taking over the domain controller.\n- Initial access is via ProxyShell on Exchange servers, giving the attacker a foothold before domain takeover.\n- Victims span U.S. and Asia across financial services, manufacturing, engineering, legal, business services, travel, and tourism sectors.\n- Ransom note is nearly identical to LockBit's, and the contact email is contact@contipauper[.]com — a direct reference to Conti.\n- Attackers typically linger several days on the network before detonating the file-encrypting payload, which is pushed to the DC and replicated to clients.\n\n## Further reading & sources\n\n- [LockFile ransomware uses PetitPotam attack to hijack Windows domains](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Flockfile-ransomware-uses-petitpotam-attack-to-hijack-windows-domains\u002F)\n- [Sequel to ChainVeil npm malware: ViteVenom - Checkmarx Zero](https:\u002F\u002Fcheckmarx.com\u002Fzero-post\u002Fsequel-to-chainveil-npm-malware-targets-vite-ecosystem)\n- [ChainDrop: Inside a Self-Propagating npm Worm](https:\u002F\u002Funit42.paloaltonetworks.com\u002Fchaindrop-npm-worm-analysis)\n- [pnpm 12’s Rust Rewrite Cuts Install Times by Up to 90% | Socket](https:\u002F\u002Fsocket.dev\u002Fblog\u002Fpnpm-12)\n- [Secure your npm and pip package updates in Amazon Linux | AWS Security Blog](https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fsecurity\u002Fsecure-your-npm-and-pip-package-updates-in-amazon-linux)\n- [Atomsilo Ransomware | WatchGuard Technologies](https:\u002F\u002Fwatchguard.com\u002Fwgrd-security-hub\u002Fransomware-tracker\u002Fatomsilo)\n- [Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache | Socket](https:\u002F\u002Fsocket.dev\u002Fblog\u002Fbundler-extends-cooldown-to-bundle-lock-and-bundle-cache)\n- [LockFile Ransomware Uses Never-Before Seen Encryption to Avoid Detection | Threatpost](https:\u002F\u002Fthreatpost.com\u002Flockfile-ransomware-avoid-detection\u002F169042\u002F)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Flockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay.png?v=3ebd8c1c3f",{"cves":19,"iocs":28,"actors":32,"malware":49,"timeline":53,"technologies":58},[20],{"id":15,"kev":21,"poc":21,"url":22,"cvss":23,"epss":24,"risk_band":25,"risk_score":26,"cvss_version":27},true,"\u002Fvulnerabilities\u002FCVE-2021-36942",7.5,0.6602,"High",72.75,"3.1",[29],{"type":30,"value":31},"email","contact@contipauper[.]com",[33,39,44],{"url":34,"name":35,"slug":36,"type":10,"origin":37,"motivation":38},"\u002Fthreat-groups\u002Flockbit","LockBit","lockbit",null,"financial",{"url":40,"name":41,"slug":42,"type":10,"origin":43,"motivation":38},"\u002Fthreat-groups\u002Fconti","Conti","conti","Russia",{"url":45,"name":46,"slug":47,"type":10,"origin":48,"motivation":38},"\u002Fthreat-groups\u002Fatomsilo","AtomSilo","atomsilo","China (attributed by trackers to the BRONZE STARLIGHT \u002F Cinnamon Tempest cluster)",[50,52],{"name":51},"efspotato.exe",{"name":46},[54],{"date":55,"event":56,"description":57},"2026-05-22","Domain registration","Three C2 domains registered",[59,62,64,67,69],{"vendor":60,"product":61},"Microsoft","Windows Domain Controller",{"vendor":60,"product":63},"Exchange",{"vendor":65,"product":66},"npm","cacheable-request",{"vendor":65,"product":68},"keyv",{"vendor":70,"product":71},"Oven","Bun","ransomware_incident","2026-09-26T07:06:42.867972+00:00","2026-10-16T12:28:07.696231+00:00",{"articles":76},[77,89,100,111],{"slug":78,"title":79,"summary":80,"tags":81,"hero_image_url":87,"story_type":72,"created_at":88},"silent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s","Silent Ransom Group Leaks Data from 64 Law Firms, Exposing Tens of Thousands of SSNs","Silent Ransom Group has published data from 64 law firms on its data leak site, including Troutman Pepper Locke, exposing tens of thousands of client SSNs and privileged legal documents.",[82,83,84,85,86,10],"Silent Ransom Group","Troutman Pepper Locke","law firm","data leak","SSN","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsilent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s.png?v=0c6f6f75f0","2026-09-21T17:04:06.647891+00:00",{"slug":90,"title":91,"summary":92,"tags":93,"hero_image_url":98,"story_type":72,"created_at":99},"dark-project-ransomware-group-hits-brainhunter-companies-llc-and-brainhunter-sys","Dark Project ransomware group hits Brainhunter Companies LLC and Brainhunter Systems Ltd.","Dark Project, a ransomware group first seen in April 2026, has published Brainhunter Companies LLC and Brainhunter Systems Ltd. as its latest victims, bringing its total to 19 known targets with 9 active extortion links on ransomware.live.",[94,95,10,96,97],"Dark Project","Brainhunter","double extortion","ransomware.live","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdark-project-ransomware-group-hits-brainhunter-companies-llc-and-brainhunter-sys.png?v=d6c0e0a4ac","2026-09-21T07:02:16.98855+00:00",{"slug":101,"title":102,"summary":103,"tags":104,"hero_image_url":109,"story_type":72,"created_at":110},"coinbasecartel-ransomware-group-claims-190-victims-across-17-sectors","CoinbaseCartel Ransomware Group Claims 190 Victims Across 17 Sectors","CoinbaseCartel, a data-exfiltration ransomware group that debuted in September 2025, has accumulated 190 claimed victims across 17 industry verticals, with recent hits on Turner & Townsend, Serruya PE, Sweet Water Holdings, Hitachi High-Tech, CEN\u002FCenelec, MIM Fertility, M.B. Kahn, Xs Cad, Accesso, Caterpillar, Colliers, PanasonicAero, Axiom Global, Demand.io, and Cambridge Mobile Telematics.",[10,105,106,107,108],"data-exfiltration","coinbasecartel","dark-web","extortion","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcoinbasecartel-ransomware-group-claims-190-victims-across-17-sectors.png?v=ad90ff5f5f","2026-09-18T17:05:03.820479+00:00",{"slug":112,"title":113,"summary":114,"tags":115,"hero_image_url":120,"story_type":72,"created_at":121},"ransomexx-deploys-esxiargs-ransomware-against-vmware-esxi-hypervisors","RansomEXX deploys ESXiArgs ransomware against VMware ESXi hypervisors","RansomEXX is running a new ESXiArgs ransomware campaign targeting VMware ESXi hypervisors, featuring a multiplatform variant and a fresh wave of infections across France and other regions.",[116,117,118,10,119],"RansomEXX","ESXiArgs","VMware ESXi","NAKIVO","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fransomexx-deploys-esxiargs-ransomware-against-vmware-esxi-hypervisors.png?v=3aea353c27","2026-08-28T07:09:31.344646+00:00"]