Tag: Active Directory Security

  • 8,200 Chat Logs Leaked as “The Gentlemen” Ransomware Syndicate is Exposed and Decrypted

    The Gentlemen collective, recently heralded as one of the most prolific ransomware enterprises of 2026, has itself fallen victim to a profound data exfiltration. Internal correspondences have been thrust into the public domain, illuminating the mundane yet predatory operations of these extortionists: their selection of targets, the orchestration of assaults, infrastructure management, and their calculated maneuvers to evade defensive systems.

    Initial reports of the breach surfaced on the Breached forum on May 4. An anonymous actor initially listed the purloined data for a ransom of $10,000 in Bitcoin before subsequently providing a MediaFire hyperlink, rendering the archive accessible to the public free of charge.

    According to Milivoje Raič, Head of Threat Intelligence at DynaRisk, the leak encompasses approximately 8,200 lines of internal chat logs, imagery of compromised systems, and temporal markers that largely align with a Moscow-based professional schedule. The materials reveal granular discussions regarding VPN access, OpenConnect, command-and-control apparatuses, payload delivery, the deactivation of EDR solutions, and the escalation of privileges to Domain Administrator within Active Directory.

    The dialogues suggest that incursions frequently originated from stolen credentials for Fortinet networking hardware. To maintain remote dominion over compromised environments, members of The Gentlemen routinely utilized the open-source ZeroPulse repository on GitHub. Prior to deploying encryption, the adversaries meticulously surveyed the network for virtualization servers, backup repositories, NAS storage, and Exchange servers, aiming to amplify the psychological pressure on the victim and sabotage recovery efforts.

    The exfiltrated data also contains Bitcoin addresses utilized for internal remuneration and the acquisition of hardware. Furthermore, the logs indicate that The Gentlemen compromised a firm bound by non-disclosure agreements with Sony and Barclays, threatening the public exposure of sensitive documents absent a settlement.

    A simultaneous blow was dealt to the syndicate by Bedrock Safeguard, which, on May 2, unveiled a public decryptor that bypasses the need for payment. The firm did not break the underlying cryptographic algorithm but instead exploited a structural vulnerability in its implementation: ephemeral cryptographic keys were inadvertently preserved within the process memory. In empirical testing, specialists successfully restored 35 out of 35 files, with the key retrieval process concluding in under a second.

    The Gentlemen emerged as a Ransomware-as-a-Service (RaaS) venture in mid-2025. By April 2026, their leak portal featured over 340 organizations that had refused to comply with their demands. According to ZeroFox, the syndicate promised affiliates up to 90% of the ransom, increasing that share to 97% for extortion efforts that eschewed encryption in favor of pure data theft. Following the release of the decryptor, the extortionists rapidly updated their malware, demonstrating the remarkable agility with which such criminal operations adapt to the countermeasures of the security community.

  • The Final Sunset: Microsoft Lays Out the 3-Phase Plan to Kill NTLM After 30 Years

    Microsoft has resolved to finally relegate NTLM to the periphery of its ecosystem, decreeing that in forthcoming Windows iterations, the protocol shall no longer be invoked by default. The corporation justifies this transition by highlighting the accumulation of cryptographic frailties that have, over decades, rendered NTLM a favored vector for adversaries infiltrating enterprise networks.

    NTLM (New Technology LAN Manager) emerged in 1993 alongside Windows NT 3.1, superseding the archaic LAN Manager. While Kerberos assumed the mantle of primary authentication within domain environments starting with Windows 2000, NTLM persisted as a ubiquitous fallback mechanism. Regrettably, this “contingency plan” has devolved into a convenient loophole; its inferior cryptography and susceptibility to diverse attack scenarios have made it an enduring liability.

    One of the most pervasive exploitation archetypes is the NTLM Relay attack. In this maneuver, an antagonist coerces a compromised device to authenticate with a rogue server under their dominion rather than the intended legitimate destination. This facilitates lateral movement and privilege escalation, culminating in the total subversion of the Windows Domain. Although defensive counters exist, they are frequently circumvented by the presence of legacy servers that continue to honor NTLM. Techniques such as PetitPotam, ShadowCoerce, DFSCoerce, and RemotePotato0 are specifically designed to bypass these restrictions and restore a viable path for relaying authentication.

    A second formidable category is the Pass-the-Hash incursion. Here, adversaries forgo the laborious process of credential cracking. Instead, they exfiltrate the NTLM hash—the derived value of the password—and utilize it directly as a surrogate for authentic credentials. Harvested via system vulnerabilities or specialized malware, these hashes empower an attacker to impersonate legitimate users, extract sensitive data, and expand their foothold across the network.

    In the next major release of Windows Server and its corresponding client versions, the protocol will cease to function as an automatic safety net. Microsoft clarifies that while the components will not be immediately excised, Windows will ship in a “secure by default” state. In this configuration, network-based NTLM is blocked, and the system exclusively prioritizes modern Kerberos-based alternatives.

    The transition is engineered to be phased, ensuring that administrators can avoid abrupt service disruptions. The inaugural stage emphasizes expanded auditing capabilities, available in Windows 11 24H2 and Windows Server 2025, allowing IT professionals to pinpoint where NTLM remains active and identify the legacy applications necessitating its use.

    The second phase, anticipated in the latter half of 2026, will introduce features designed to mitigate common “fallback” scenarios. Key elements include IAKerb and a Local Key Distribution Center (Local KDC). These components act as bridges to Kerberos in environments where NTLM was previously the path of least resistance due to architectural idiosyncrasies.

    In the final stage, network NTLM will be deactivated by default in future releases. The protocol will remain dormant within the OS, accessible only through explicit policy overrides. Microsoft thus preserves an “emergency switch” for organizations burdened by legacy infrastructure while ensuring the standard operational state is as resilient and predictable as possible.

    This strategic pivot follows years of deliberate preparation. The intention to sunset NTLM was publicly articulated in October 2023, followed by its official designation as a deprecated mechanism in July 2024. Microsoft’s exhortations to developers to abandon NTLM in favor of Kerberos or Negotiate date back to 2010, underscoring a long-standing commitment to eradicating this legacy vulnerability.

  • BREADS: BREaking Active Directory Security

    BREADS – BREaking Active Directory Security

    BREADS is a tool focused on enumerating and attacking Active Directory environments through LDAP and SMB protocols. This project is inspired by other existing tools like NetExec (CrackMapExec) and Impacket.

    Active Directory Security

    Features

    • Profile management
    • Support Kerberoasting
    • Change User Password
    • Add User to Group
    • ACEs Enumeration
    • Interactive Shell
    • Support to Pass-The-Hash
    • Others

    Installation

    ~$ apt install pipx
    ~$ pipx ensurepath
    ~$ pipx install git+https://github.com/oppsec/breads.git
    ~$ breads-ad

    • Arch Linux based Distros: If you encounter any error when trying to install you might use –break-system-packages flag

    Use

    Copyright (c) 2024 oppsec