NTLM Relay Attacks Surge 300% — Microsoft Issues Urgent Guidance
Microsoft's threat intelligence team reported a 300% increase in NTLM relay attacks targeting Windows environments in Q1 2026. SMBs using on-premises Active Directory are particularly at risk.
What Are NTLM Relay Attacks
NTLM (NT LAN Manager) is a legacy Windows authentication protocol that has been largely superseded by Kerberos but remains widely used in Windows environments for backward compatibility. NTLM relay attacks exploit a fundamental weakness in the NTLM authentication process: when a Windows system authenticates to a server using NTLM, an attacker positioned between the client and server can capture the authentication exchange and relay it to a different server, effectively impersonating the victim. This allows attackers to authenticate to other systems on the network using the victim's credentials without ever knowing the actual password.
Why Attacks Are Surging
Microsoft's threat intelligence team observed a 300% increase in NTLM relay attacks in Q1 2026 compared to Q1 2025. Several factors are driving this surge. First, improved tooling — open-source attack tools like Responder and ntlmrelayx have become more sophisticated and easier to use. Second, many organizations still have NTLM enabled throughout their environments due to legacy application dependencies. Third, attackers have found new techniques to trigger NTLM authentication from victim systems, including through malicious Office documents, printer spooler abuse, and WebDAV coercion. Once an attacker gains a foothold on a network — even with limited privileges — NTLM relay attacks can quickly escalate to domain administrator access.
Mitigations and Protections
Microsoft recommends a layered approach to mitigating NTLM relay attacks. First, enable SMB signing on all Windows systems — this prevents relay attacks over SMB. Second, enable LDAP signing and channel binding on all domain controllers — this prevents relay attacks targeting Active Directory. Third, enable Extended Protection for Authentication (EPA) on all IIS and Exchange servers. Fourth, consider disabling NTLM entirely if your environment supports it — Microsoft has published guidance on how to audit and gradually disable NTLM. Fifth, implement network segmentation to limit the blast radius if an attacker does gain a foothold.
- Disable NTLM authentication where possible — use Kerberos instead
- Enable Extended Protection for Authentication (EPA) on all IIS and Exchange servers
- Enable SMB signing on all Windows systems to prevent relay attacks
- Implement LDAP signing and channel binding on all domain controllers
- Contact Segler.Net to assess your NTLM exposure and implement mitigations
Need Help With This Threat?
Our San Antonio security team can assess your exposure, apply patches, and protect your business before attackers strike.
Stay ahead of the next threat
Get weekly security alerts — breaches, patch updates, compliance news, and threat intel — delivered free to your inbox every week.