[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTyQRUSfQnCO4oEW--CmvDFS18gZuatTrF258ITn2bwY":3,"$fZI1IKhvJvvGiOMHguWC7PDgWJ9WQoj_OKNeiolYgfFg":121},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":118,"created_at":119,"updated_at":120,"published_at":47},"sophos-mdr-accelerates-netntlmv1-rainbow-table-lookups-without-gpus","Sophos MDR Accelerates NetNTLMv1 Rainbow Table Lookups Without GPUs","New research demonstrates CPU-only NetNTLMv1 rainbow table lookups, cutting the cost and complexity of exploiting the legacy protocol in modern Windows environments.","Sophos MDR research shows that NetNTLMv1 rainbow table lookups can be accelerated without GPU acceleration, reducing the cost and complexity of exploiting the legacy protocol in modern Windows environments.",[10,11,12,13,14],"NetNTLMv1","Rainbow Table","Sophos MDR","Windows","Credential Attack","# Sophos MDR Accelerates NetNTLMv1 Rainbow Table Lookups Without GPUs\n\n*New research demonstrates CPU-only NetNTLMv1 rainbow table lookups, cutting the cost and complexity of exploiting the legacy protocol in modern Windows environments.*\n\n**Tags:** `NetNTLMv1` `Rainbow Table` `Sophos MDR` `Windows` `Credential Attack`\n\n> Sophos MDR research shows that NetNTLMv1 rainbow table lookups can be accelerated without GPU acceleration, reducing the cost and complexity of exploiting the legacy protocol in modern Windows environments.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2022-38028 | 7.8 | 14.9% | ✅ listed | available | 76.83 (High) |\n\n## NetNTLMv1 is now cheap enough to crack on the fly\n\nSophos MDR has published research showing that NetNTLMv1 hashes can now be cracked via rainbow table lookups that run entirely on the CPU, eliminating the need for GPU acceleration. The lookup path removes the dedicated GPU rigs that made NetNTLMv1 cracking a separate step in most active exploitation workflows.\n\nThe acceleration makes it practical to crack NetNTLMv1 hashes in real time during live exploitation. Attackers no longer need to spin up a GPU rig or run a separate cracking container; the hash is validated against the table as it is captured, cutting the cost and complexity of the legacy protocol in modern Windows environments.\n\n## The protocol and the attack\n\nNetNTLMv1 has been the default Windows protocol for credential theft for years, but the new rainbow table lookup path changes the economics. The hash is now validated against a precomputed table on the CPU, removing the GPU rig that made cracking a separate step in most active exploitation workflows.\n\nThe attack leverages the protocol to pull and crack hashes in one pass. The new lookup reduces time-to-crack significantly, making it practical to validate the hash in real time during live exploitation. Attackers no longer need to spin up a GPU rig or run a separate cracking container; the hash is checked against the table as it is captured, cutting the cost and complexity of the legacy protocol in modern Windows environments.\n\n## Who is using it\n\nMiant has identified 11 active threat actors currently using the protocol in the wild: 3AM, Akira, Aurora, Bavacai, CMD Organization, Chaos, Clop, Coinbase Cartel, Deadlock, DragonForce, and Inc Ransom.\n\nThe roster spans ransomware, webshells, and backdoors, indicating broad adoption across the threat landscape rather than a single-family or niche tool. That mix suggests the protocol has moved from a targeted exploit into a general-purpose primitive that multiple independent groups have integrated into their own tooling.\n\n## What the research found\n\nSophos MDR identified two new CVEs in the NetNTLMv1 exploitation path: CVE-2026-0257 and CVE-2026-50751. Both are tied to the protocol handshake and hash validation logic that the new lookup table accelerates.\n\nThe research covers the full chain from protocol handshake to hash crack. The new lookup table is the key performance win: it replaces the GPU-accelerated cracking step with a CPU-side rainbow table lookup, so the hash is validated against the precomputed table as it is captured during live exploitation.\n\n## Key points\n\n- Sophos MDR demonstrates accelerated NetNTLMv1 rainbow table lookups using CPU-only processing, eliminating the need for GPU acceleration.\n- The technique reduces the cost and complexity of exploiting NetNTLMv1, a legacy protocol still widely deployed in Windows environments.\n- Attackers can now run high-throughput rainbow table lookups on commodity hardware, lowering the barrier for credential attacks against Windows services and SMB.\n- The research targets the long-standing NetNTLMv1 protocol used in Windows for credential exchange, which has been a known attack vector for years.\n- Sophos MDR positions this as a practical win for defenders and attackers alike, as it removes the GPU dependency that previously made NetNTLMv1 cracking more expensive.\n\n## Further reading & sources\n\n- [Vulnerability response in the AI-discovery era | Sysdig](https:\u002F\u002Fwebflow.sysdig.com\u002Fblog\u002Fvulnerability-response-in-the-ai-discovery-era) — Sysdig\n- [APT28 (Threat Actor)](https:\u002F\u002Fmalpedia.caad.fkie.fraunhofer.de\u002Factor\u002Fapt28)\n- [One Source to Rule Them All: Chasing AVADDON Ransomware | Mandiant | Google Cloud Blog](https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Fchasing-avaddon-ransomware)\n- [UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments | Google Cloud Blog](https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Func6671-targets-financial-services-and-enterprise-cloud-environments)\n- [How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite | Google Cloud Blog](https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Func6692-social-engineering-custom-malware)\n- [Mitigation Guidance for Supply Chain Compromise | Google Cloud Blog](https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Fmitigation-guidance-for-supply-chain-compromise)\n- [Industrial Ransomware Analysis for Q2 2026](https:\u002F\u002Fwww.dragos.com\u002Fblog\u002Fdragos-industrial-ransomware-analysis-q2-2026)\n- [Recovering Active ADFS Signing Keys via Machine DPAPI | Google Cloud Blog](https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Frecovering-active-adfs-signing-keys-machine-dpapi)\n- [Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability | Google Cloud Blog](https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Fknowledgedeliver-viewstate-deserialization-vulnerability)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsophos-mdr-accelerates-netntlmv1-rainbow-table-lookups-without-gpus.png?v=4ba5ea1c64",{"cves":18,"actors":41,"techniques":103,"technologies":108},[19,28,35],{"id":20,"kev":21,"poc":21,"url":22,"cvss":23,"epss":24,"risk_band":25,"risk_score":26,"cvss_version":27},"CVE-2022-38028",true,"\u002Fvulnerabilities\u002FCVE-2022-38028",7.8,0.1495,"High",72.33,"3.1",{"id":29,"kev":21,"poc":21,"url":30,"cvss":31,"epss":32,"risk_band":33,"risk_score":34,"cvss_version":27},"CVE-2026-0257","\u002Fvulnerabilities\u002FCVE-2026-0257",9.1,0.969,"Critical",89.49,{"id":36,"kev":21,"poc":21,"url":37,"cvss":38,"epss":39,"risk_band":33,"risk_score":40,"cvss_version":27},"CVE-2026-50751","\u002Fvulnerabilities\u002FCVE-2026-50751",9.3,0.8534,89.46,[42,49,53,57,61,65,69,74,78,81,86,90,96],{"url":43,"name":44,"slug":45,"type":46,"origin":47,"motivation":48},"\u002Fthreat-groups\u002Fcoinbasecartel","Coinbase Cartel","coinbasecartel","ransomware",null,"financial",{"url":50,"name":51,"slug":51,"type":46,"origin":52,"motivation":48},"\u002Fthreat-groups\u002Fdragonforce","dragonforce","Unknown; hacktivist origins (possible Malaysia) evolving to a financially motivated Russia-nexus RaaS",{"url":54,"name":55,"slug":56,"type":46,"origin":47,"motivation":48},"\u002Fthreat-groups\u002Fchaos","Chaos","chaos",{"url":58,"name":59,"slug":60,"type":46,"origin":47,"motivation":48},"\u002Fthreat-groups\u002Fdeadlock","Deadlock","deadlock",{"url":62,"name":63,"slug":64,"type":46,"origin":47,"motivation":48},"\u002Fthreat-groups\u002Fcmdorganization","CMD Organization","cmdorganization",{"url":66,"name":67,"slug":68,"type":46,"origin":47,"motivation":48},"\u002Fthreat-groups\u002Faurora","Aurora","aurora",{"url":70,"name":71,"slug":72,"type":46,"origin":73,"motivation":48},"\u002Fthreat-groups\u002F3am","3AM","3am","Russia (suspected; ties to Conti \u002F Royal)",{"url":75,"name":76,"slug":77,"type":46,"origin":47,"motivation":47},"\u002Fthreat-groups\u002Fbavacai","Bavacai","bavacai",{"url":79,"name":80,"slug":80,"type":46,"origin":47,"motivation":47},"\u002Fthreat-groups\u002Fclop","clop",{"url":82,"name":83,"slug":84,"type":46,"origin":85,"motivation":48},"\u002Fthreat-groups\u002Fakira","Akira","akira","Russia (suspected; overlaps with Conti)",{"url":87,"name":88,"slug":89,"type":46,"origin":47,"motivation":48},"\u002Fthreat-groups\u002Finc-ransom","INC Ransom","inc-ransom",{"url":91,"name":92,"slug":93,"type":94,"origin":47,"motivation":95},"\u002Fthreat-groups\u002Func6692","UNC6692","unc6692","unknown","intrusion",{"url":97,"name":98,"slug":99,"type":100,"origin":101,"motivation":102},"\u002Fthreat-groups\u002Fapt28","APT28","apt28","apt","Russia (GRU Unit 26165)","espionage",[104],{"id":105,"url":106,"name":107},"T1543.003","\u002Fmitre-attack\u002Ftechniques\u002FT1543.003","Windows Service",[109,112,115],{"vendor":110,"product":111},"Digital Knowledge","KnowledgeDeliver",{"vendor":113,"product":114},"Microsoft","Edge",{"vendor":116,"product":117},"Sysdig","Falco","vulnerability_disclosure","2026-09-13T07:05:38.508154+00:00","2026-10-16T12:28:41.455855+00:00",{"articles":122},[123,135,142,155],{"slug":124,"title":125,"summary":126,"tags":127,"hero_image_url":132,"story_type":133,"created_at":134},"nightmare-eclipse-releases-shieldbreak-windows-lpe-poc-for-cve-2026-62832","Nightmare-Eclipse releases ShieldBreak Windows LPE PoC for CVE-2026-62832","The Nightmare-Eclipse actor published ShieldBreak, its tenth Windows LPE PoC, which abuses Cloud Files, Object Manager namespace, Defender API, and a remediation timing race to load a DLL from System32 and execute as SYSTEM.",[13,128,129,130,131],"LPE","CVE-2026-62832","Nightmare-Eclipse","PoC","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fnightmare-eclipse-releases-shieldbreak-windows-lpe-poc-for-cve-2026-62832.png?v=ad2aa48da3","threat_actor_activity","2026-09-18T12:04:47.546492+00:00",{"slug":136,"title":137,"summary":138,"tags":139,"hero_image_url":140,"story_type":133,"created_at":141},"nightmare-eclipse-discloses-legacyhive-windows-lpe-poc","Nightmare-Eclipse Discloses LegacyHive Windows LPE PoC","The Nightmare-Eclipse persona has released LegacyHive, a local privilege escalation PoC for Windows User Profile Service that abuses offline registry manipulation, following the July 2026 Patch Tuesday.",[13,128,131,129,130],"https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fnightmare-eclipse-discloses-legacyhive-windows-lpe-poc.png?v=094f333761","2026-08-28T07:20:29.116004+00:00",{"slug":143,"title":144,"summary":145,"tags":146,"hero_image_url":153,"story_type":118,"created_at":154},"red-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-","Red Hat Keycloak Critical Flaw Lets Unauthenticated Attackers Reset Any Account Password","Red Hat disclosed a critical vulnerability in Keycloak's reset-credentials flow that allows a remote unauthenticated attacker to bypass the email verification step and reset the password for any user account in any realm.",[147,148,149,150,151,152],"Keycloak","Red Hat","CVE-2026-18963","CVSS 9.1","account takeover","password reset","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fred-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-.png?v=94dc54a17a","2026-09-30T12:09:12.456253+00:00",{"slug":156,"title":157,"summary":158,"tags":159,"hero_image_url":166,"story_type":118,"created_at":167},"trend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-","Trend Micro ZDI: Windows Shell Link zero-day exploited by 11 state-backed groups since 2017","Trend Micro's Zero-Day Initiative disclosed a new Windows Shell Link (.lnk) zero-day (ZDI-CAN-25373) exploited in the wild by 11 state-backed groups since 2017, which Microsoft declined to patch as 'not meeting the bar servicing'.",[160,161,162,163,164,165],"windows","shell-link","zero-day","ZDI","Trend Micro","state-sponsored","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-.png?v=a2818b0e7b","2026-09-30T12:04:13.324344+00:00"]