Signed, Sealed, and Relayed, NTLM-style: Bypassing LDAP Signing Through Reauthentication

Reported by SpecterOps (Raj Patel)

Summary by Cyber Security News23 Oct 2026, 18:08 CET

About this summary. This is a short excerpt from the description that SpecterOps published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://specterops.io/blog/2026/10/23/ldap-signing-bypass-ntlm-relay/

For years, we thought LDAP and SMB signing protected us from NTLM relay attacks. However, we found that both protocols could be relay targets through re-authentication on a connection the attacker already owned. Signing was still enforced, just with the attacker known session key.

Read the full article at SpecterOps →

Source attribution: headline and facts are from SpecterOps (specterops.io). Summary method: excerpt of the source description. See our source attribution policy.