Activity timeline
T1557.001 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 4 reports, and 13 of the 13 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1557.001 Name Resolution Poisoning and SMB Relay is catalogued by MITRE ATT&CK under the Credential Access and Collection tactics in the Enterprise matrix, as a sub-technique of T1557 Adversary-in-the-Middle. Threadlinqs maps 13 of 2623 tracked threats (0.5%) to it; by severity that is 5 critical, 7 high, 1 medium.
Threats that use T1557.001 most often also use T1187 Forced Authentication (9 threats), T1046 Network Service Discovery (8 threats), T1018 Remote System Discovery (7 threats), T1078.002 Domain Accounts (7 threats), T1021.002 SMB/Windows Admin Shares (6 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
1 tracked threat actor appear in the threats that use T1557.001; the most frequent are The Gentlemen (1).
Mitigations
MITRE ATT&CK lists 4 mitigations for T1557.001.
Data sources
Telemetry that can reveal T1557.001, per MITRE ATT&CK.
- Network Traffic — Network Traffic Content, Network Traffic Flow
- Service — Service Creation
- Windows Registry — Windows Registry Key Modification
Threat actors using it
Tracked threats
13 tracked threats use T1557.001.
- "Spring Ring" Vishing Campaign Abuses Microsoft Teams, Quick Assist, and PetitPotam for NTLM Relayhigh
- Aurora Ransomware Affiliate Uses Cursor AI Coding Assistant for Attack Planning, ADCS Abuse Across 20+ Victimshigh
- WSUS NTLM Relay Attack Chain Enables Malicious Update Deployment via SUSDB Stored Procedureshigh
- CVE-2026-54121 ("Certighost"): Low-Privileged AD CS Enrollment Flaw Enables Domain Controller Impersonationcritical
- Oracle Hospitality Simphony Vulnerabilities: NTLM Hash Disclosure, Arbitrary File Write, and Kiosk…critical
- The Gentlemen RaaS overtakes Qilin as #1 ransomware operation, wields GentleKiller EDR-killer framework…high
- The Gentlemen Ransomware: Worm-Like Self-Propagation and Network-Wide Encryption via Storm-2697's RaaS…critical
- Unpatched Windows search: URI Handler NTLMv2 Hash Leak via crumb=location UNC Coercion (No CVE, Microsoft…high
- Multi-Stage Linux Intrusion via End-of-Life F5 BIG-IP and Unpatched Confluence — SSH Foothold to NTLM Relay…high
- CVE-2026-32202 — Windows Shell Protection Mechanism Failure: NTLM Authentication Coercion via Auto-Parsed…critical
- AI-Augmented FortiGate Mass Exploitation — Russian-Speaking Actor Breaches 600+ Firewalls Across 55…critical
- Microsoft NTLM Deprecation - Three-Stage Phase-Out Planhigh
- Microsoft NTLM Phase-Out: Detection & Migration Guidancemedium
Detection coverage
Threadlinqs maintains 55 detection rules mapped to T1557.001 (SPL 19, KQL 19, Sigma 17). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1557 Adversary-in-the-Middle — 170 tracked threats at the technique level.