Signed, Sealed, and Relayed, NTLM-style: Bypassing LDAP Signing Through Reauthentication
SpecterOps researchers demonstrated that NTLM relay attacks can bypass LDAP and SMB signing through re-authentication on attacker-owned connections — undermining a mitigation many enterprises have relied on for years until Microsoft's recent fix.
Summary written by editorial AI · Source link below
For years, we thought LDAP and SMB signing protected us from NTLM relay attacks. However, we found that both protocols could be relay targets through re-authentication on a connection the attacker already owned. Signing was still enforced, just with the attacker known session key. Microsoft fixed SMB quietly in September 2026 and LDAP in October […] The post Signed, Sealed, and Relayed, NTLM-style: Bypassing LDAP Signing Through Reauthentication appeared first on SpecterOps .
Editorial Analysis
Many European enterprises still depend on NTLM in hybrid AD environments; learning that signing alone did not prevent relay attacks should accelerate NTLM phase-out and patch verification.
Confirm deployment of Microsoft's fix for the LDAP signing bypass and add NTLM deprecation milestones to your identity roadmap.
A newly disclosed technique bypassed NTLM relay protections that enterprises have trusted for years — the fix is available but NTLM phase-out should be accelerated.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at SpecterOps in a new tab.
More from the Research Desk
- Not Where You Think: Protecting Location Privacy Against Reasoning-Based Geolocation4d
- Social-HUMINT: An LLM-Augmented Unified Framework for Measuring Social Media Exposure4d
- Practical Auditing of Differentially Private Graph Release Mechanisms: Methodology, Toolkit, and Case Study4d
- SecLog-Bench: A Scalable Benchmark for Cybersecurity Log Reasoning with Scaffolded Evidence4d
- ReDence: A Hybrid Agentic and Decision-Model Framework for Rapid, Evidence-Grounded Detection of Modern Social Engineering Scams4d