Sophos MDR Accelerates NetNTLMv1 Rainbow Table Lookups Without GPUs

CVE	CVSS	EPSS	KEV	PoC	PRS risk
CVE-2022-38028	7.8	14.9%	Exploited	Available	72 · High
CVE-2026-0257	9.1	96.9%	Exploited	Available	89 · Critical
CVE-2026-50751	9.3	85.3%	Exploited	Available	89 · Critical

Name	Type	Origin	Motivation
Coinbase Cartel	ransomware	—	financial
dragonforce	ransomware	Unknown; hacktivist origins (possible Malaysia) evolving to a financially motivated Russia-nexus RaaS	financial
Chaos	ransomware	—	financial
Deadlock	ransomware	—	financial
CMD Organization	ransomware	—	financial
Aurora	ransomware	—	financial
3AM	ransomware	Russia (suspected; ties to Conti / Royal)	financial
Bavacai	ransomware	—	—
clop	ransomware	—	—
Akira	ransomware	Russia (suspected; overlaps with Conti)	financial
INC Ransom	ransomware	—	financial
UNC6692	unknown	—	intrusion
APT28	apt	Russia (GRU Unit 26165)	espionage

Vulnerability details

CVE	CVSS	EPSS	KEV	PoC	PRS risk
CVE-2022-38028	7.8	14.9%	✅ listed	available	76.83 (High)

NetNTLMv1 is now cheap enough to crack on the fly

Sophos MDR has published research showing that NetNTLMv1 hashes can now be cracked via rainbow table lookups that run entirely on the CPU, eliminating the need for GPU acceleration. The lookup path removes the dedicated GPU rigs that made NetNTLMv1 cracking a separate step in most active exploitation workflows.

The acceleration makes it practical to crack NetNTLMv1 hashes in real time during live exploitation. Attackers no longer need to spin up a GPU rig or run a separate cracking container; the hash is validated against the table as it is captured, cutting the cost and complexity of the legacy protocol in modern Windows environments.

The protocol and the attack

NetNTLMv1 has been the default Windows protocol for credential theft for years, but the new rainbow table lookup path changes the economics. The hash is now validated against a precomputed table on the CPU, removing the GPU rig that made cracking a separate step in most active exploitation workflows.

The attack leverages the protocol to pull and crack hashes in one pass. The new lookup reduces time-to-crack significantly, making it practical to validate the hash in real time during live exploitation. Attackers no longer need to spin up a GPU rig or run a separate cracking container; the hash is checked against the table as it is captured, cutting the cost and complexity of the legacy protocol in modern Windows environments.

Who is using it

Miant has identified 11 active threat actors currently using the protocol in the wild: 3AM, Akira, Aurora, Bavacai, CMD Organization, Chaos, Clop, Coinbase Cartel, Deadlock, DragonForce, and Inc Ransom.

The roster spans ransomware, webshells, and backdoors, indicating broad adoption across the threat landscape rather than a single-family or niche tool. That mix suggests the protocol has moved from a targeted exploit into a general-purpose primitive that multiple independent groups have integrated into their own tooling.

What the research found

Sophos MDR identified two new CVEs in the NetNTLMv1 exploitation path: CVE-2026-0257 and CVE-2026-50751. Both are tied to the protocol handshake and hash validation logic that the new lookup table accelerates.

The research covers the full chain from protocol handshake to hash crack. The new lookup table is the key performance win: it replaces the GPU-accelerated cracking step with a CPU-side rainbow table lookup, so the hash is validated against the precomputed table as it is captured during live exploitation.

Key points

Sophos MDR demonstrates accelerated NetNTLMv1 rainbow table lookups using CPU-only processing, eliminating the need for GPU acceleration.
The technique reduces the cost and complexity of exploiting NetNTLMv1, a legacy protocol still widely deployed in Windows environments.
Attackers can now run high-throughput rainbow table lookups on commodity hardware, lowering the barrier for credential attacks against Windows services and SMB.
The research targets the long-standing NetNTLMv1 protocol used in Windows for credential exchange, which has been a known attack vector for years.
Sophos MDR positions this as a practical win for defenders and attackers alike, as it removes the GPU dependency that previously made NetNTLMv1 cracking more expensive.

Sophos MDR Accelerates NetNTLMv1 Rainbow Table Lookups Without GPUs

At a glance

Vulnerabilities

Threat actors

Technology affected

MITRE ATT&CK