You Thought It Was Over? Authentication Coercion Keeps Evolving
Summary: Unit 42 reports that authentication coercion attacks force Windows machines, including Domain Controllers, to authenticate to attacker-controlled systems and hand over hashed credentials without any special permissions. In a March 2025 case at a healthcare organization, an attacker used the rarely monitored MS-EVEN RPC interface and the ElfrOpenBELW function to coerce a Citrix server and a Read-Only Domain Controller into authenticating to command-and-control servers, then relayed NTLM authentication to certificate authority servers and attempted DCSync with stolen DC hashes.
Bottom line: A public repository lists 16 working coercion functions across five protocols, with over 240 more untested - so defenses tuned to PrintNightmare and PetitPotam leave the opnums attackers are pivoting to unwatched. In this case the attacker forced a Citrix server and an RODC to authenticate to its C2, then relayed those machine account hashes to certificate authority servers.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2021-36942
- Related
- CVE-2021-36942: Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021