A cybercriminal operating under the alias ByteToBreach has emerged as a prominent figure in the underground data trade, orchestrating a series of high-profile breaches targeting critical sectors worldwide. Active since at least June 2025, ByteToBreach has leveraged a blend of technical proficiency, aggressive self-promotion, and cross-platform operations to become one of the most publicized threat […]
More than two decades after its initial discovery, the NTLM authentication protocol continues to plague Windows systems worldwide.
What started in 2001 as a theoretical vulnerability has evolved into a widespread security crisis, with attackers actively weaponizing multiple NTLM flaws to compromise networks across different regions.
The New Technology LAN Manager (NTLM) protocol was designed to authenticate clients and servers in Windows environments using a three-step handshake.
Although Microsoft has announced plans to retire NTLM entirely, beginning with Windows 11 24H2 and Windows Server 2025, the protocol remains embedded in millions of systems.
This persistence creates an open window for cybercriminals who continue to discover and exploit new vulnerabilities in NTLM’s outdated mechanisms.
Multiple Attack Vectors Under Active Exploitation
NTLM flaws enable several dangerous attack techniques. Hash leakage occurs when attackers craft malicious files that trick Windows into sending authentication hashes without requiring user interaction.
CVE ID
Severity
Affected Systems
Impact
Known Campaigns
CVE-2024-43451
High
Windows (Multiple Versions)
Hash Leakage, Credential Compromise
BlindEagle (Remcos RAT), Head Mare
CVE-2025-24054/CVE-2025-24071
High
Windows 11, Windows Server
Hash Leakage, Unauthorized Access
Trojan Distribution in Russia (AveMaria/Warzone)
CVE-2025-33073
High
Windows (SMB Client)
Privilege Escalation to SYSTEM Level
Uzbekistan Financial Sector Attack
Coercion-based attacks force systems to authenticate to attacker-controlled services.
Once credentials are compromised, attackers use credential-forwarding techniques such as Pass-the-Hash to move laterally across networks and escalate privileges without knowing the actual passwords.
Man-in-the-middle attacks remain particularly effective, with NTLM relay remaining the most impactful method for two decades. Attackers position themselves between clients and servers to intercept authentication traffic and capture credentials.
Security researchers have identified several critical NTLM vulnerabilities that are currently being actively exploited in 2024 and 2025.
CVE-2024-43451 enables NTLMv2 hash leakage through malicious .url files. Simply interacting with these files clicking, right-clicking, or moving them automatically connects to attacker servers running WebDAV.
The BlindEagle APT group exploited this vulnerability to distribute the Remcos RAT to Colombian targets. At the same time, the Head Mare hacktivists exploited it against Russian and Belarusian organizations.
CVE-2025-24054 and CVE-2025-24071 target .library-ms files inside ZIP archives, causing automatic NTLM authentication to attacker-controlled servers. Researchers detected campaigns in Russia distributing the AveMaria Trojan using this method.
CVE-2025-33073 represents a hazardous reflection attack. Attackers manipulate DNS records to trick Windows into treating external authentication requests as local, bypassing regular security checks and granting SYSTEM-level privileges.
According to SecureList, suspicious activity exploiting this vulnerability was detected in Uzbekistan’s financial sector.
Despite Microsoft addressing these vulnerabilities through patches, the legacy protocol’s continued presence in enterprise networks means attacks will persist.
Organizations maintaining NTLM for compatibility with older applications remain particularly vulnerable. Security teams should prioritize migrating to Kerberos, implementing network segmentation, and monitoring for suspicious authentication attempts across their Windows infrastructure.
Cybercriminals are now selling lifetime access to malicious AI chatbots WormGPT and KawaiiGPT for as little as $220, marking a dangerous new chapter in AI-powered cybercrime.
These tools remove all ethical restrictions found in mainstream AI models, enabling attackers to generate phishing emails, create ransomware, and automate hacking operations with minimal technical skill.
Large language models present a fundamental challenge for security professionals. The same capabilities that make AI useful for defense also make it powerful for attacks.
Attackers can use AI to generate convincing phishing messages, create malware code, and automate reconnaissance activities. The line between a helpful research tool and a dangerous weapon often depends only on the user’s intent.
WormGPT Returns with Commercial Pricing
The original WormGPT appeared in July 2023 as one of the first commercial malicious AI tools. Built on the open-source GPT-J 6B model, it was trained on malware code, exploit guides, and phishing templates.
WormGPT ad found on Hack Forums.
After media attention forced its shutdown, the brand has returned as WormGPT 4.
The new version operates through Telegram and underground forums with transparent subscription pricing. Monthly access costs $50, annual access costs $175, and lifetime access costs $220.
WormGPT 4 generates a rudimentary ransomware script impacting PDF files
The tool has attracted over 500 subscribers to its Telegram channel since sales began around September 27, 2025.
Unit 42 researchers tested WormGPT 4 and found that it can instantly generate working ransomware scripts.
When asked to create code to encrypt PDF files, it produced a functional PowerShell script using AES-256 encryption with command-and-control server support. The model also creates professional ransom notes with 72-hour payment deadlines.
KawaiiGPT Offers Free Access
While WormGPT requires payment, KawaiiGPT provides similar capabilities completely free. First identified in July 2025, this tool is available on GitHub and can be set up in under five minutes on Linux systems.
KawaiiGPT generates a spear phishing message
Despite its cute name and friendly interface, KawaiiGPT generates dangerous content.
Researchers found it can create convincing spear-phishing emails that appear to come from banks, produce Python scripts for lateral network movement, and generate code for data exfiltration targeting email files.
Example of a ransom note created from a prompt in KawaiiGPT
According to Palo Alto Networks, the tool claims to have over 500 registered users, with several hundred active users each week. An active Telegram community of 180 members shares tips and feature requests.
These tools represent a significant shift in the threat landscape. Previously, creating convincing phishing campaigns or functional malware required substantial technical expertise.
Now, anyone with internet access can use these AI tools to launch sophisticated attacks in minutes rather than days.
Security defenders can no longer rely on traditional warning signs, such as poor grammar or sloppy code, to identify threats.
The democratization of AI-powered cybercrime means organizations must strengthen their defenses against increasingly polished and automated attacks.
In a significant escalation of cyber threats, Arctic Wolf Labs has identified a coordinated campaign in which the Russian-aligned RomCom threat group leverages the SocGholish malware to target a U.S.-based engineering firm with suspected ties to Ukraine. This marks the first documented instance of RomCom payloads being distributed through SocGholish’s infrastructure, signaling a dangerous convergence […]
A new offensive security tool developed in Rust is demonstrating a novel method for bypassing modern Endpoint Detection and Response (EDR) systems by exploiting an overlooked behavior in the Windows API.
Dubbed Indirect-Shellcode-Executor, the tool leverages the ReadProcessMemory function to inject shellcode, effectively avoiding standard API calls that security vendors monitor for malicious activity.
The core of this technique relies on research originally discovered by security researcher Jean-Pierre LESUEUR (DarkCoderSc). While ReadProcessMemory is designed to read data from a specific process, it contains an [out] pointer parameter named *lpNumberOfBytesRead.
This parameter is intended to report how much data was successfully read. However, by manipulating this pointer, an attacker can force the API to write data into the process memory.
This behavior creates a “write primitive” using a “read” function. Because the tool avoids standard memory manipulation APIs such as WriteProcessMemory or memcpy it creates a blind spot for Antivirus (AV) and EDR solutions that rely on hooking those specific functions to detect code injection.
Rust-Based Implementation for Red Teams
The Indirect-Shellcode-Executor, developed by researcher Mimorep, is a fully operational Proof of Concept (PoC) written in Rust. Unlike theoretical exploits, this tool is designed for immediate use in Red Team operations to test defensive postures.
The tool compiles specifically for x32 architectures (via i686-pc-windows-msvc) and offers three distinct attack surface scenarios for operators:
Remote Payload Execution: The tool can fetch shellcode directly from a remote Command and Control (C2) server (e.g., hiding a payload inside a PNG file) and execute it in memory.
Terminal Injection: Operators can pass shellcode strings or binaries directly through the command line interface for immediate execution.
File-Based Execution: The tool can read payloads concealed within local files, such as documents or temporary files, and inject them into the process.
This tool highlights the persistent challenge facing security vendors: the Windows API is vast, and legitimate functions can often be repurposed for evasion.
By utilizing *lpNumberOfBytesRead to construct a payload byte-by-byte, the Indirect-Shellcode-Executor operates underneath the radar of heuristic analysis that looks for rapid memory writing sequences.
The developer has made the tool open-source to demonstrate the vulnerability, crediting DarkCoderSc for the initial discovery of the pointer vulnerability, which was documented on the Unprotect Project.
Security teams are advised to review their API monitoring rules to account for unusual calls to ReadProcessMemory, particularly those where the output pointer targets executable memory sections.
Enterprises today are expected to have at least 6-8 detection tools, as detection is considered a standard investment and the first line of defense. Yet security leaders struggle to justify dedicating resources further down the alert lifecycle to their superiors.
As a result, most organizations’ security investments are asymmetrical, robust detection tools paired with an under-resourced SOC,
The telecommunications & media sector stands at the epicenter of a relentless cyber onslaught, as evidenced by CYFIRMA’s latest quarterly industry report. Leveraging telemetry-driven intelligence and deep-dive threat research. The report unveils alarming trends in advanced attack campaigns, surging underground chatter, and evolving ransomware dynamics, painting a picture of a sector under siege and in […]
If you’re using community tools like Chocolatey or Winget to keep systems updated, you’re not alone. These platforms are fast, flexible, and easy to work with—making them favorites for IT teams. But there’s a catch…
The very tools that make your job easier might also be the reason your systems are at risk.
These tools are run by the community. That means anyone can add or update packages. Some
Cybersecurity researchers have discovered a new malicious extension on the Chrome Web Store that’s capable of injecting a stealthy Solana transfer into a swap transaction and transferring the funds to an attacker-controlled cryptocurrency wallet.
The extension, named Crypto Copilot, was first published by a user named “sjclark76” on May 7, 2024. The developer describes the browser add-on as
Security researchers at Cato CTRL have uncovered HashJack. This innovative indirect prompt-injection attack hides harmful commands in the fragment portion of URLs after the “#” symbol. This technique turns trusted websites into weapons against AI browser assistants like Perplexity’s Comet, Microsoft’s Copilot in Edge, and Google’s Gemini in Chrome. How The Attack Unfolds HashJack exploits […]
