Microsoft patched a critical zero-day Windows Server Local Security Authority (LSA) spoofing vulnerability which has been exploited In-the-Wild, allowing threat actors to escalate their privileges, giving them full control of the domain. LSA is a Windows subsystem used to enforce the security policies on local and remote machines. The flaw, tracked as CVE-2022-26925, appears to be related to the infamous “PetitPotam,” Windows New Technology LAN Manager (NTLM) relay attacks on Active Directory Certificate Services (AD CS), first identified in the summer of 2021 and abused by the “LockFile” ransomware group. Although critical, this exploitation is a highly complex attack, and requires sophisticated threat actors to conduct a Man-in-the-Middle (MITM) attack to request a method on the LSA Remote Procedure Call (LSARPC) interface. This could allow them to remotely intercept legitimate authentication requests, coercing the domain controller to authenticate the attackers via the NTLM security protocol. Once the attackers have control, they can execute malware, leak sensitive data, and carry out other malicious network activity. The security update fixes the vulnerability by detecting and blocking anonymous LSARPC connection attempts. This flaw affects all versions of Windows Server, and according to Microsoft’s advisory, “domain controllers should be prioritized in terms of applying security updates.” Additional manual hardening techniques for mitigating NTLM relay attacks in-general are detailed in the Windows advisory linked below. The CTIX team urges any-and-all Windows network administrators to ensure their infrastructure reflects the most current security posture, and that they have added defense-in-depth for protecting against NTLM attacks.