Mandiant has unveiled a powerful tool in the form of a rainbow table that can crack NTLMv1 authentication credentials in less than 12 hours using consumer-grade hardware costing less than $600. This move, supported by Google’s cloud infrastructure, underscores the critical vulnerabilities associated with the longstanding Net-NTLMv1 protocol.
Despite being deprecated for more than two decades and officially replaced by the more secure Kerberos protocol, NTLMv1 still lingers within numerous organizational frameworks, often obscured within third-party firmwares like those of printers or as a legacy fallback in Windows systems. Its persistence is a significant concern, as attackers commonly exploit it through phishing attacks and relay attacks, posing a serious risk to network security.
Mandiant’s release not only highlights the ease with which security professionals can now crack these credentials but also serves as a clarion call for expedited deprecation of the insecure protocol. The comprehensive rainbow tables, freely available for security professionals, include detailed instructions on employing the tables, acquiring Net-NTLMv1 hashes through coercion attacks, and executing DCSync attacks against domain controllers.
With recent updates from Microsoft, which include the removal of NTLMv1 support in upcoming releases of Windows Server 2025 and Windows 11, many organizations are still unaware of the protocol running in their networks. Therefore, the urgency for disabling NTLMv1 via Group Policy settings has never been greater. Organizations are advised to implement monitoring mechanisms to detect NTLMv1 usage promptly and ensure a complete transition to secure authentication methods.
The release has stirred the cybersecurity community, not only due to its potential impact on security practices but also because it starkly brings to the forefront the exigent need for organizations to review and update their system protocols in the face of evolving cyber threats.

Collections

Mandiant released a rainbow table that can crack NTLMv1 authentication credentials in under 12 hours using consumer hardware under $600. Despite being deprecated for over 20 years and replaced by Kerberos, NTLMv1 persists in many organizations through legacy systems and third-party firmware. The free tool includes instructions for security professionals to crack credentials and execute attacks. Microsoft is removing NTLMv1 support in Windows Server 2025 and Windows 11, but many organizations remain unaware of its presence in their networks. The release emphasizes the urgent need for organizations to disable NTLMv1 via Group Policy and transition to secure authentication methods.

Mandiant Releases Rainbow Tables to Address NTLMv1 Protocol Vulnerabilities