CVE-2025-24054: NTLM Exploit in the Wild – A Deep Look at the Latest NTLM Hash Disclosure Vulnerability

By Edi Rimkus

In our fast-evolving threat landscape, even long-trusted authentication protocols are coming under fire. The newly disclosed vulnerability, CVE-2025-24054, has been making headlines as it enables NTLM hash disclosure via spoofing, and its exploitation in the wild is raising alarms across both public and private sectors. Check Point Research has documented active abuse of this flaw, which poses severe risks to Windows environments worldwide.

Understanding NTLM and Its Significance

NTLM (New Technology LAN Manager) is a suite of authentication protocols developed by Microsoft to verify user identities during network logins. NTLM uses the challenge/response mechanism where a user's credentials are not transmitted in plain text but are instead hashed. With the introduction of NTLMv2, Microsoft improved security by incorporating both server and client challenges into the authentication process. However, as attackers have proven time and again, even these improvements are not impervious. When an NTLM hash is intercepted, it can be relayed in pass-the-hash attacks or brute-forced offline, potentially paving the way for privilege escalation and lateral movement within networks.

The Vulnerability: CVE-2025-24054

CVE-2025-24054 is a critical flaw related to NTLM hash disclosure through spoofing techniques. At its core, the vulnerability is triggered by maliciously crafted .library-ms files. Here’s how the exploit works:

• Trigger Mechanism:
  Although originally believed to require a full execution of the malicious file, later analysis (and Microsoft’s patch documentation) indicated that minimal user interactions—such as right-clicking, drag-and-dropping, or merely navigating to the folder containing the file—are sufficient to activate the exploit.

• Exploitation Process:
  The crafted .library-ms file forces Windows Explorer to initiate an SMB (Server Message Block) authentication request to a remote server controlled by the attacker. As a result, the system accidentally relays the user’s NTLMv2-SSP hash. Once leaked, these hashes can be brute-forced to recover user passwords or relayed in further attacks to impersonate the user.

• Similarity to Past Vulnerabilities:
  This vulnerability shares striking characteristics with CVE-2024-43451, indicating that threat actors are reusing and evolving techniques that exploit weaknesses in NTLM even after security improvements.

Active Exploitation in the Wild

Despite Microsoft releasing a patch on March 11, 2025, attackers wasted no time. Active exploitation was first noted on March 19, 2025—just eight days after the patch. A notable campaign, dubbed the "NTLM Exploits Bomb," targeted government and private institutions in Poland and Romania around March 20–21, 2025.

Real-World Campaign Details

• Distribution Method:
  Victims received malspam emails containing Dropbox-hosted archives. These archives often included multiple files such as:

  • xd.library-ms – the primary file exploiting CVE-2025-24054

  • xd.url, xd.website, and xd.lnk – additional files capable of triggering SMB authentication requests

• User Interaction Abuse:
  What makes this exploitation particularly dangerous is that it does not rely on complex user actions. Simply accessing the folder containing these malicious files—without even opening or executing them—can trigger the NTLM authentication and leak the hashes.

• Global Impact:
  Attackers have set up SMB servers in various regions including Russia, Bulgaria, the Netherlands, Australia, and Turkey to collect the leaked authentication data. Downstream, these NTLMv2-SSP hashes are being used for offline brute force, NTLM relay attacks, and potentially full network compromise if the affected credentials belong to privileged users.

Implications and Threat Landscape

NTLM hash disclosure vulnerabilities like CVE-2025-24054 represent a significant shift in attack vectors. With minimal interaction required to trigger the leak, attackers can stealthily capture critical security data from unsuspecting users. The fact that threat actors quickly weaponized this vulnerability post-patch emphasizes two things:

• The Need for Rapid Response: Organizations must implement patch management policies that not only focus on timely updates but also verify the effectiveness of applied patches.

• Evolving Attack Tactics: Cybercriminals continue to refine their techniques by combining social engineering (e.g., malspam campaigns with convincing Dropbox links) with technical exploits, ensuring that even robust security measures can be bypassed with minimal effort.

Recommendations for Mitigation

Organizations can take several steps to protect themselves:

• Apply Patches Immediately: Ensure every Windows system is updated with the latest patches released on March 11, 2025, to reduce vulnerability exposure.

• User Awareness Training: Educate employees on the risks of interacting with suspicious emails and files—emphasizing that even minimal actions can trigger these exploits.

• Enhanced Monitoring: Deploy advanced threat detection and monitoring systems, particularly focused on SMB traffic and unusual authentication requests.

• Network Segmentation and SMB Hardening: Limit exposure by segmenting networks and enforcing strict SMB security policies, such as SMB signing, to mitigate the risk of NTLM relay attacks.

• Incident Response Preparedness: Develop and test incident response protocols specifically tailored to credential compromise and lateral movement scenarios.

Conclusion

CVE-2025-24054 underscores the persistent challenges facing cybersecurity professionals when defending legacy protocols like NTLM. As attackers continuously adapt, organizations must remain agile—ensuring that they not only deploy patches promptly but also adopt a layered defense strategy. By understanding the mechanics of this exploit and learning from real-world campaigns, we can turn these vulnerabilities into lessons for building a more resilient security posture.

Stay vigilant, keep your systems updated, and continue to refine your defenses in the face of ever-evolving threats.

Feel free to share your thoughts or leave comments below if you have additional insights on mitigating NTLM-based threats. Let’s work together to foster a safer digital environment.