NTLMv1 rainbow table could crack admin passwords in hours, pressuring migration

Mandiant released a Google Cloud-hosted rainbow table for Net-NTLMv1 that can recover admin passwords in under 12 hours on consumer hardware, highlighting NTLMv1’s weak keyspace and its continued use in sensitive networks. While meant to aid defenders in proving NTLMv1’s insecurity and pushing migration, the table also lowers barriers for attackers when paired with tools like Responder, PetitPotam, and DFSCoerce. Microsoft deprecated NTLMv1, and organizations are urged to disable Net-NTLMv1 despite legacy-application constraints.