{"id":8588,"date":"2024-03-04T18:10:40","date_gmt":"2024-03-04T09:10:40","guid":{"rendered":"https:\/\/cyberenso.jp\/?p=8588"},"modified":"2024-11-19T18:13:49","modified_gmt":"2024-11-19T09:13:49","slug":"ntlm-authentication-hashes-are-stolen-during-phishing-attacks-by-hackers","status":"publish","type":"post","link":"https:\/\/cyberenso.jp\/en\/ntlm-authentication-hashes-are-stolen-during-phishing-attacks-by-hackers\/","title":{"rendered":"NTLM authentication hashes are stolen during phishing attacks by hackers"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"8588\" class=\"elementor elementor-8588\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-b076e93 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"b076e93\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-f8b94bd\" data-id=\"f8b94bd\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-4e53375 elementor-widget elementor-widget-text-editor\" data-id=\"4e53375\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>As a result of a recent shift in tactics, the hacking group known as TA577 has employed phishing emails to steal the authentication hashes of NT LAN Manager (NTLM) accounts in order to use them for account hijackings. The NTLM hash is a key component of Windows authentication and session security and can be used for offline password cracking to obtain plaintext passwords. They can also be used in &#8220;pass-the-hash&#8221; attacks that do not involve cracking at all, where the attackers use the hash as it is to authenticate to a remote server or service without cracking.<br \/><br \/>An effective measure is to configure a firewall to block all outbound SMB connections, stop NTLM hashes from being sent, and implement email filtering to block messages containing zipped HTML files, as these can trigger unsafe endpoint connections when launched. To prevent sending NTLM hashes, you can also configure &#8216;Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers&#8217;.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>As a result of a recent shift in tactics, the hacking group known as TA577 has employed phishing emails to steal the authentication hashes of NT LAN Manager (NTLM) accounts in order to use them for account hijackings. The NTLM hash is a key component of Windows authentication and session security and can be used for offline password cracking to<span class=\"excerpt-hellip\"> [\u2026]<\/span><\/p>\n","protected":false},"author":1,"featured_media":8595,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[225,6,10,8,1],"tags":[],"class_list":["post-8588","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-heavy-industry","category-latest_news","category-latest_vulnerabilities","category-industry_sector","category-uncategorized"],"acf":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/cyberenso.jp\/wp-content\/uploads\/2024\/03\/Pic1.jpg?fit=640%2C426&ssl=1","_links":{"self":[{"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/posts\/8588"}],"collection":[{"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/comments?post=8588"}],"version-history":[{"count":5,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/posts\/8588\/revisions"}],"predecessor-version":[{"id":8594,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/posts\/8588\/revisions\/8594"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/media\/8595"}],"wp:attachment":[{"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/media?parent=8588"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/categories?post=8588"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/tags?post=8588"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}