TA577 Tactics: NTLM Hash Theft Through SMB Thread Hijacking by: Marianne Bermejo
Evaluates TA577 Tactics: NTLM Hash Theft Through SMB Thread Hijacking by: Marianne Bermejo and evaluates key implications for security practitioners.
Summary
## Overview Fiber Security Group researchers Marianne Bermejo and Mark detail TA577's campaign stealing NTLM hashes via malicious HTML and SMB redirection.
## Attack Chain Spearphishing delivers an archive containing HTML. Opening it triggers SMB connection to an attacker-controlled server; Wireshark or Responder captures Net-NTLM hashes for offline cracking or relay.
## Demonstration Live lab setup shows pass-the-hash granting access to a victim workstation—including browsing directories and finding plaintext credentials saved in text files, a common user mistake.
## Takeaways Block outbound SMB where possible, train users on HTML/LNK tricks, and never store passwords in cleartext—TA577's technique is reproducible with standard Kali/impacket tooling.
Related talks
Ekoparty Security Conference·42 min
Ochoa · Azubel
Presents ochoa & Azubel - Understanding the Win SMB NTLM weak nonce vulnerability and evaluates key implications for security practitioners.
Ekoparty Security Conference·36 min
Leandro Cuozzo
Outlines explotando NTLM como si fueran los 2000 and evaluates key implications for security practitioners.
Ekoparty Security Conference·29 min
Ignacio Agustin Randazzo
Discusses FPGAs for password/hash cracking - Ignacio Agustin Randazzo and evaluates key implications for security practitioners.