CVE-2025-24054 Exploited: Awareness Needed as Credential Theft Surges

CVE-2025-24054 Exploited: Awareness Needed as Credential Theft Surges

At a glance

• Incident Alert: CVE-2025-24054, a Windows NTLM flaw that leaks password hashes, is being exploited in the wild.
• Effective Hacker Strategies: Attackers send phishing emails with archives that trigger the leak when a user simply opens the folder.
• Urgent Response Required: Microsoft patched the flaw in March 2025; unpatched systems remain exposed.
• Widespread Impact: Early attacks hit government and private organizations in Poland and Romania.
• Industry Vigilance: CISA added the flaw to its Known Exploited Vulnerabilities catalog on April 17, 2025.

A patched Windows bug under attack

CVE-2025-24054 is a Windows NTLM hash disclosure flaw that Microsoft fixed in its March 11, 2025 updates. Attackers moved fast. Check Point Research reported exploitation starting March 19, about eight days after the patch, and CISA added the bug to its Known Exploited Vulnerabilities catalog on April 17. Its severity score is moderate, but the real-world risk is credential theft, which is why defenders are treating it as urgent.

What the flaw does

The bug lets an attacker capture a user’s NTLMv2 password hash over the network. That hash can be cracked offline or relayed. Very little user interaction is needed: right-clicking, dragging or just opening a folder containing a crafted file can be enough.

How the attacks work

Check Point said a campaign around March 20 and 21 targeted government and private institutions in Poland and Romania. Phishing emails linked to a Dropbox-hosted ZIP archive. Inside was a malicious .library-ms file. When Windows processed the file, it reached out to an attacker-controlled SMB server and sent the user’s hash.

What CISA and Microsoft say to do

Microsoft’s fix is in the March 2025 Patch Tuesday updates. Under CISA’s KEV listing, federal civilian agencies had until May 8, 2025 to patch. Everyone else should patch too, and blocking outbound SMB traffic to the internet stops the hash from leaving the network.

Who is exposed

Any unpatched Windows system is at risk, from government offices to small businesses. A stolen hash is a foothold.

What defenders are watching

Security vendors are publishing detections for the attack chain. NTLM has a long history of hash-leak bugs like this one.

Microsoft has been steering customers away from NTLM toward Kerberos for years. Reducing NTLM use where possible removes this whole class of attack.

Patch, then cut back on NTLM

CVE-2025-24054 shows how quickly attackers turn a patched bug into a working campaign. Confirm the March 2025 updates are installed. Then block outbound SMB at the firewall and watch for unusual NTLM authentication, which shuts down this attack and others like it.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.