CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

LDAP Switcheroo

tool · tool:ldap-switcheroo

SpecterOps proof of concept, a modified wrapper around ntlmrelayx, that relays a coerced SMB client's NTLM authentication to a domain controller requiring LDAP signing and runs an LDAP modification with the victim's rights (SpecterOps, 2026-10-23).

Aliases: switcheroo

Coverage
1
first 2026-10-25 → last 2026-10-25
Latest activity
2026-10-25
Required LDAP and SMB signing did not stop NTLM relay: a re-authenticated session kept the attacker's key
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
4
3 hosts

Action items (1)

Do-now tasks recorded on the entries about LDAP Switcheroo, newest first. Check the date before acting on an older one.

  • Confirm that every domain controller has the cumulative update of 2026-10-13 and every Windows server the September 2026 one for its Windows release (SpecterOps names KB5126646, the October update for Windows Server 2025, and KB5122882, the September update for Windows Server 2022; other releases have their own packages), then list the computer accounts whose msDS-AllowedToActOnBehalfOfOtherIdentity or msDS-KeyCredentialLink holds a value nobody set, because patching does not remove what a relay already wrote.
    2026-10-25Required LDAP and SMB signing did not stop NTLM…

Defender insights

What each entry about LDAP Switcheroo tells a defender to do, newest first.

2026-10-25NOTABLERequired LDAP and SMB signing did not stop NTLM relay: a re-authenticated session kept the attacker's key

Exposure · detection

Story timeline

  1. 2026-10-25NTLM relay past required signing: SpecterOps and Blackfield re-authenticate a signed LDAP or SMB session with a relayed victim identity, and Microsoft fixed it in the September and October 2026 updates
    researchRequired LDAP and SMB signing did not stop NTLM relay: a re-authenticated session kept the attacker's key

Hunting pivots

Affected products
Microsoft Windows Server
Tags
auth-bypassidentitypatch-availablepoc-public
ATT&CK techniques (5 across 4 tactics)

5 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • PersistenceAccount Manipulation
  • Privilege EscalationAccount Manipulation
  • Credential AccessOS Credential Dumping: DCSync · Forced Authentication · Adversary-in-the-Middle · Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay
  • CollectionAdversary-in-the-Middle · Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay

Persistence TA0003

T1098Account Manipulation×1

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

Evidence: 2026-10-25/ntlm-relay-signing-bypass-reauthentication-ldap-smb · ATT&CK page ↗

Privilege Escalation TA0004

T1098Account Manipulation×1

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

Evidence: 2026-10-25/ntlm-relay-signing-bypass-reauthentication-ldap-smb · ATT&CK page ↗

Credential Access TA0006

T1003.006OS Credential Dumping: DCSync×1

Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API) to simulate the replication process from a remote domain controller using a technique called DCSync.

Evidence: 2026-10-25/ntlm-relay-signing-bypass-reauthentication-ldap-smb · ATT&CK page ↗

T1187Forced Authentication×1

Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.

Evidence: 2026-10-25/ntlm-relay-signing-bypass-reauthentication-ldap-smb · ATT&CK page ↗

T1557Adversary-in-the-Middle×1

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.

Evidence: 2026-10-25/ntlm-relay-signing-bypass-reauthentication-ldap-smb · ATT&CK page ↗

T1557.001Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay×1

By responding to LLMNR/NBT-NS/mDNS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. This activity may be used to collect or relay authentication materials.

Evidence: 2026-10-25/ntlm-relay-signing-bypass-reauthentication-ldap-smb · ATT&CK page ↗

Collection TA0009

T1557Adversary-in-the-Middle×1

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.

Evidence: 2026-10-25/ntlm-relay-signing-bypass-reauthentication-ldap-smb · ATT&CK page ↗

T1557.001Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay×1

By responding to LLMNR/NBT-NS/mDNS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. This activity may be used to collect or relay authentication materials.

Evidence: 2026-10-25/ntlm-relay-signing-bypass-reauthentication-ldap-smb · ATT&CK page ↗

Entries about LDAP Switcheroo (1)

2026-10-25 · view entry permalink →

NOTABLENATOB2

NTLM relay past required signing: SpecterOps and Blackfield re-authenticate a signed LDAP or SMB session with a relayed victim identity, and Microsoft fixed it in the September and October 2026 updates

SpecterOps and Blackfield show that NTLM relay to a server that requires signing works again when the attacker first owns a signed session and then re-authenticates it with the victim's identity, so the session keeps the attacker's signing key. For LDAP, the attacker signs a session to a domain controller with valid credentials or, where accepted, an anonymous NTLM context, coerces a victim over SMB, and sends the victim's relayed authentication with a malicious LDAP modification in one SASL record signed with the attacker's key; the controller checks the signature once, switches to the victim's identity and runs the modification with the victim's rights (SpecterOps, 2026-10-23). The tested controller enforced LDAP signing and channel binding and the attack still worked over 389/TCP; the demonstration writes the resource-based constrained delegation attribute, and relaying a domain controller's machine account to another controller leads to DCSync and domain compromise (SpecterOps, 2026-10-23). Blackfield shows the SMB counterpart: a server keeps the original signing key on re-authentication without checking that the identity matches, so on any host that requires SMB signing, domain controllers included, a relayed privileged authentication yields a privileged session still signed with the low-privilege key, provided the attacker can capture or coerce that authentication (Blackfield, 2026-10-21).

SpecterOps reported the LDAP flaw to Microsoft on 2026-10-06, received no response, and says the fix shipped in the 2026-10-13 cumulative update, KB5126646, while the SMB variant was patched quietly in September 2026 (KB5122882) (SpecterOps, 2026-10-23). KB5126646 is the October update for Windows Server 2025 and KB5122882 the September update for Windows Server 2022 (Microsoft, 2026-10-13; Microsoft, 2026-09-08), so each release needs its own cumulative update of the month. Blackfield found no CVE or KB note for the SMB change, says similar changes seem to have reached the other supported versions in the following weeks without having traced every build, and warns that one or two end-of-life versions may never receive it (Blackfield, 2026-10-21). Both publish tooling; neither reports use in attacks (SpecterOps, 2026-10-23; Blackfield, 2026-10-21).

The domain controller we tested against had both LDAP signing and channel binding enforced, and the attack still worked over 389/TCP.

We independently identified a similar vulnerability in SMB, and Microsoft patched it quietly in September 2026.

SpecterOps 2026-10-23

On any host that requires SMB signing, Domain Controllers included, a relayed privileged authentication yields a privileged session that is still signed with the low-privilege key.

I could not find a CVE for this specific change, in Microsoft’s update guide, the KB notes, or public trackers; it reads as silent hardening rather than a tracked fix.

Blackfield 2026-10-21
research25 Oct 03:34Zmulti-sourceOpen finding →
Sources: SpecterOps · Blackfield · Microsoft (KB5126646, Windows Server 2025) · Microsoft (KB5122882, Windows Server 2022)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Research1

Source distribution

  • support.microsoft.com2 (50%)
  • blackfield.ch1 (25%)
  • specterops.io1 (25%)
All cited sources (4)