CVE AdvisoryMEDIUMIntermediate5 min read

Windows NTLM Hash Disclosure (CVE-2025-24054) Actively Exploited in Phishing Campaigns

A zero-click NTLM hash leak via .library-ms files is being actively exploited in phishing campaigns targeting government and private sector organizations in Poland and Romania.

April 1, 2025Verified

Microsoft MSRC ESET Research

What Happened

CVE-2025-24054 is a Windows NTLM hash disclosure vulnerability patched in March 2025 Patch Tuesday. By crafting a malicious .library-ms file (Windows Library definition file), an attacker can cause Windows Explorer to initiate an automatic SMB authentication attempt to an attacker-controlled server, leaking the user's NTLMv2 hash. ESET Research observed active exploitation campaigns targeting government organizations across Poland and Romania within days of the patch's release.

Why This Is Severe Despite CVSS 6.5

The 'Medium' CVSS rating understates real-world risk. The hash leak:

Requires no user clicks — browsing to a folder containing the file is sufficient
Enables NTLM relay attacks against internal services
Can be used to crack NTLMv2 hashes offline (common passwords crack in minutes)
Works even if the file is in a ZIP attachment previewed in Explorer

Recommended Actions

Apply March 2025 Patch Tuesday (KB5053594 for Windows 11 24H2)
Enable SMB signing on all domain controllers and member servers via GPO
Enable Extended Protection for Authentication (EPA) on IIS/Exchange
Block outbound SMB (TCP 445) at the network perimeter
Disable NTLM authentication where Kerberos is available (set Network security: Restrict NTLM to Deny all)
Monitor Windows Security Event ID 4624 (LogonType=3, NTLM) for unusual patterns

Microsoft Windows NTLM Relay T1557 Adversary-in-the-Middle Government

NEWSCVE-2024-55591

#StopRansomware: Gunra Ransomware

Advisory at a Glance Title #StopRansomware: Gunra Ransomware Original Publication August 10, 2026 Executive Summary Gunra is a ransomware-as-a-service (RaaS) used by affiliates to target government, critical infrastru...

WHY IT MATTERS

Official CISA advisory — read the full bulletin for impact and mitigation guidance before acting.

MicrosoftFortinetGoogle+2 more

1d ago· 28 min read

NEWSHIGHCVE-2025-14847

ABB Ability Zenon

Successful exploitation of these vulnerabilities could allow attackers to bypass security, crash systems, execute unauthorized actions, or compromise data. The following versions of ABB Ability Zenon are affected: IIo...

WHY IT MATTERS

Successful exploitation of these vulnerabilities could allow attackers to bypass security, crash systems, execute unauthorized actions, or compromise data.

WindowsDenial of ServiceHealthcare

5d ago· 22 min read

TOOL

Shadow AI Audit: Find Which AI Apps Can Read Your Company Data in Entra ID

A free, read-only PowerShell audit that lists every AI application holding OAuth consent in your Microsoft Entra ID tenant — who approved it, what it can read, and whether it holds a refresh token that survives a password change.

WHY IT MATTERS

One employee clicking Accept on an AI app can grant it standing access to everything that user can reach. Tenant-wide admin consent extends that to everyone. Neither shows up in a vulnerability scan, and neither is revoked by a password reset.

Shadow AIEntra IDOAuth+2 more

12d ago· 5 min read

What Happened

Why This Is Severe Despite CVSS 6.5

Recommended Actions

Related

#StopRansomware: Gunra Ransomware

ABB Ability Zenon

Shadow AI Audit: Find Which AI Apps Can Read Your Company Data in Entra ID