Live Cyber Attack Lab 🎯 Watch our IR team detect & respond to a rogue insider trying to steal data! Choose a Session


Threat Update 53 – ProxyShell and PetitPotam and Ransomware… Oh My!

Cybersecurity News, Incident Response

Technology grows, evolves, and changes over time, but most organizations often need to support legacy systems. In the Microsoft world, this typically means keeping legacy authentication protocols like NTLM authentication around despite their known shortcomings. The new PetitPotam attack exploits some of these legacy protocols to take over Windows domains.

Join Kilian and Kyle Roth from the Varonis Incident Response team as they discuss the background of the PetitPotam attack, how attackers and ransomware operators are weaponizing it, and tips to help defend against it.

Articles referenced in this episode:

New PetitPotam attack allows take over of Windows domains 

LockFile ransomware uses PetitPotam attack to hijack Windows domains

👉To learn how else we can help, please visit us at:


Kilian Englert

Kilian Englert

Kilian has a background in enterprise security engineering, as well as security solution selling. Kilian is a Certified Information Systems Security Professional (CISSP) and creates internal and public content on topics related to cyber security and technology best practices.


Does your cybersecurity start at the heart?

Get a highly customized data risk assessment run by engineers who are obsessed with data security.