Hunting the Undead: Accelerating NetNTLMv1 Lookups Without GPUs
2026-08-17T20:51:31Z•775cfb9241d25e9f2f41caff851781984e63d3d6f8bf0f02579e91176ef5dd65
CVE-2026-18577AI securityClickFixDFIR tool abuseDenoGOLD EMBRACEInterlockLiving-off-the-LandN-able N-centralNetNTLMv1RMMcompromised WordPresscredential crackingdouble extortionfileless executioninfostealernetwork tunnelingpersistent accessransomware
What happened
Sophos reporting highlights active and emerging threats including accelerated NetNTLMv1 cracking, ClickFix campaigns abusing compromised WordPress sites and alternative runtimes such as Deno to deliver infostealers, ransomware operators abusing legitimate DFIR tools, and exploitation of N-able N-central (CVE-2026-18577) to deploy RMM tools and network tunnels for persistent access. The collection also includes defensive AI and DNS-filtering updates and AI security research.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sophos_news
- Record identifier
- 775cfb9241d25e9f2f41caff851781984e63d3d6f8bf0f02579e91176ef5dd65
- Enrichment time
- 2026-08-17T20:51:31Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.