Pass-the-Hash Attacks: Why They Still Devastate Small Networks in 2026

June 6, 2026 • BizVuln Staff

Discover what pass-the-hash is, how attackers exploit NTLM hash weaknesses, and why small businesses are prime targets. Expert mitigation guide for 2026.

Pass-the-Hash Attacks: Why They Still Devastate Small Networks in 2026

The clock on your domain controller reads 02:47 AM. In a mid-market law firm, the night shift IT admin—if they exist—is asleep. On the network, a single compromised workstation belonging to a paralegal has just been used to spray a stolen NTLM hash across the file server. Within 90 seconds, the attacker has administrative access to the entire client database. No password was cracked. No brute force was required. The damage is done before the coffee pot brews.

This is Pass-the-Hash (PtH) . It is not new. It is not exotic. And in 2026, it remains the single most effective lateral movement technique against small to medium-sized networks that rely on legacy authentication protocols.

The Anatomy of a PtH Attack

To understand why PtH is so devastating, you must first understand how Windows authentication works at the protocol level—specifically, the NTLM (NT LAN Manager) hash.

How Windows Stores Credentials

When a user logs into a Windows machine, the system does not store their plaintext password. Instead, it computes a cryptographic hash using the NTLM hash algorithm (a series of MD4-based operations) and stores it in the Local Security Authority Subsystem Service (LSASS) process memory. This hash is the key that proves identity to other machines on the network.

The critical flaw? The hash *is* the password for authentication purposes. If an attacker obtains the NTLM hash of a domain administrator, they do not need to reverse-engineer the plaintext. They can present that hash directly to a remote server during the NTLM challenge-response handshake, and the server will accept it as valid proof of identity.

The Attack Flow

1. Initial Compromise: The attacker gains access to a single endpoint—often through a phishing email, a malicious Office macro, or an unpatched vulnerability in a line-of-business application.

2. Privilege Escalation (Local): Using tools like Mimikatz or SharpKatz, the attacker extracts cached NTLM hashes from LSASS memory. On a local admin account, this is trivial. On a standard user account, they may first exploit a local privilege escalation (e.g., a vulnerable driver or a misconfigured service).

3. Lateral Movement: The attacker now has a list of hashes. They use built-in Windows tools (`psexec`, `wmic`, `schtasks`) or offensive frameworks (Cobalt Strike, Sliver) to authenticate to other machines using the stolen hashes. No password cracking is required.

4. Hash Harvesting on New Hosts: On each newly compromised machine, the process repeats. The attacker dumps LSASS again, often finding cached credentials of domain admins who have logged into that server for maintenance.

5. Domain Dominance: Once a Domain Admin hash is obtained, the attacker can authenticate to the Domain Controller directly, create new accounts, disable logging, deploy ransomware, or exfiltrate data.

Why Small Networks Are Particularly Vulnerable

Large enterprises often deploy Protected Users Security Groups, Credential Guard, and Windows Defender for Identity to block PtH at scale. Small networks—those with 10 to 200 employees—rarely have the budget or expertise for these measures. Common configurations that enable PtH in small environments include:

• **Local admin accounts with identical passwords** across all workstations.
• **Service accounts running with domain admin privileges** because "it was easier to set up."
• **Legacy Windows versions (Server 2012 R2, Windows 10 pre-22H2)** still in production.
• **No LSA protection** enabled, leaving LSASS memory open to dumping.
• **RDP enabled on domain controllers** for remote management convenience.

The 2026 Threat Landscape: Why PtH Is Worse Than Ever

You might assume that after two decades of awareness, PtH would be a solved problem. The reality is more concerning. Three converging trends make PtH more dangerous for small networks in 2026:

The Rise of "Living off the Land" (LotL)

Modern attackers increasingly avoid dropping custom binaries on target machines. Instead, they use native Windows tools (`PowerShell`, `WMIC`, `BITSAdmin`, `certutil`) to move laterally. PtH fits perfectly into this paradigm because the attacker only needs to pass a hash to `Invoke-WmiMethod` or `New-PSSession`. No malware is written to disk, evading traditional signature-based antivirus.

The Decline of SMB1 but the Persistence of NTLM

While SMB1 (the protocol most associated with EternalBlue-style attacks) has been disabled by default since Windows 10 version 1709, NTLM itself remains deeply embedded in Windows networking. Kerberos is the preferred protocol, but NTLM is the fallback for nearly every cross-domain, non-domain-joined, or legacy application scenario. In small networks with third-party hardware (printers, NAS devices, security cameras), NTLM is often the only option.

Ransomware Groups Have Operationalized PtH

In 2024 and 2025, major ransomware-as-a-service (RaaS) operations—including LockBit 3.0 and BlackCat/ALPHV variants—incorporated automated PtH modules into their deployment pipelines. By 2026, this technique is standardized. A threat actor can purchase a "corporate network access" for as little as $500 on dark web forums, with the understanding that PtH will work against 80% of small business targets.

The Business Impact: Beyond the Technical

For a small business, a PtH-based attack is rarely a "minor incident." The consequences cascade:

• **Complete Domain Compromise:** Because PtH allows lateral movement without detection, an attacker can encrypt every server and workstation in under an hour. Backup systems are often accessed and encrypted first.
• **Regulatory Fines:** If the compromised network handles PII (legal firms, healthcare clinics, accounting practices), a PtH breach that leads to data exfiltration can trigger GDPR, HIPAA, or CCPA penalties. Average fines for small businesses in 2025 exceeded $150,000.
• **Reputational Damage:** Clients of small service providers expect confidentiality. A breach resulting from "a simple hash attack" can destroy trust permanently.

How to Defend Against Pass-the-Hash: The 2026 Checklist

The following controls are ranked by immediate impact for small networks. Implement them in this order to achieve the fastest risk reduction.

H3: 1. Enable LSA Protection on All Domain-Joined Machines

What it does: Prevents non-protected processes from accessing LSASS memory. This blocks most credential dumping tools (Mimikatz, ProcDump) from extracting hashes.

How to implement:

• Set the registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL` to `dword:00000001`.
• For Windows 10/11 22H2 and later, enable **Local Security Authority (LSA) Credential Guard** via Group Policy: `Computer Configuration > Administrative Templates > System > Device Guard > Turn On Virtualization Based Security`.

Caveat: Requires UEFI, Secure Boot, and virtualization support. Most modern hardware supports this.

H3: 2. Implement the "Protected Users" Security Group

What it does: When a user is added to the Protected Users group, Windows refuses to cache their NTLM hashes in LSASS. Even if an attacker dumps memory, they will find no usable hash for that account.

How to implement:

• Create a Global Security Group in Active Directory named "Protected Users."
• Add all Domain Admin, Enterprise Admin, and high-privilege service accounts to this group.
• Deploy the Group Policy setting: `Computer Configuration > Administrative Templates > System > Kerberos > Not allow offline logon` for these users.

Critical note: This breaks NTLM authentication for those users. They will only be able to use Kerberos. Ensure all applications and network paths support Kerberos before enabling.

H3: 3. Eliminate Local Admin Password Reuse

What it does: The most common PtH vector is a compromised workstation whose local admin password is identical to the local admin on the file server.

How to implement:

• Use **Microsoft Local Administrator Password Solution (LAPS)** . Deploy the latest version (LAPS v6.0+) which stores randomized passwords in Active Directory.
• Ensure that every workstation and server has a unique local admin password.
• Rotate passwords every 30-90 days automatically.

H3: 4. Disable NTLM Where Feasible

What it does: PtH requires NTLM. If you eliminate NTLM entirely, the attack fails at the protocol level.

How to implement:

• Set **Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers** to "Deny all" via Group Policy.
• Set **Network security: Restrict NTLM: NTLM authentication in this domain** to "Deny domain accounts to domain servers."
• Test thoroughly. Many printers, scanners, and legacy applications break without NTLM. Use **NTLM audit logs** (Event ID 8001-8004) to identify dependencies before blocking.

H3: 5. Deploy Endpoint Detection and Response (EDR) with LSASS Access Monitoring

What it does: Modern EDR solutions can detect and block unauthorized attempts to open LSASS process handles.

How to implement:

• Choose an EDR that supports **LSASS protection telemetry** (Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne).
• Create detection rules for `lsass.exe` access by non-`winlogon.exe` processes.
• Enable **Attack Surface Reduction (ASR) rules** in Microsoft Defender: "Block credential stealing from the Windows local security authority subsystem."

H3: 6. Implement the "Tiering Model" for Administration

What it does: Prevents domain admin credentials from ever being cached on a workstation.

How to implement:

• Create a dedicated **"Admin Workstation"** (Tier 0) that is only used for domain controller management.
• Domain admins must use their admin account *only* on this workstation. They use a separate standard user account for daily email and browsing.
• **Never log into a workstation with a domain admin account**—not even for troubleshooting.

H3: 7. Enable Windows Defender Credential Guard

What it does: Isolates LSASS within a virtualized container, making it impossible for user-mode processes (including malware) to read hashes.

How to implement:

• Enable via Group Policy: `Computer Configuration > Administrative Templates > System > Device Guard > Turn On Virtualization Based Security` > Select "Enabled with UEFI lock."
• Requires Windows 10 Enterprise or Education edition. For small businesses without Enterprise licensing, consider **Windows 11 Pro** with **Hyper-V** enabled.

Real-World Case Study: The $200,000 PtH Breach

In Q1 2025, a regional accounting firm with 45 employees suffered a PtH attack that originated from a single infected workstation. The attacker used a phishing email disguised as a tax authority notice. The user clicked a link that downloaded a malicious `.docm` file.

Within 12 minutes of execution, the attacker had:

1. Dumped LSASS on the workstation (obtained the user's NTLM hash).

2. Sprayed that hash against the file server (found the user had local admin rights on the server due to a legacy application requirement).

3. Dumped LSASS on the file server (obtained the Domain Admin hash from a cached session).

4. Encrypted the Domain Controller and all 12 virtual servers.

The firm's backup system was on the same domain. It was encrypted as well. Recovery required paying a $50,000 ransom, hiring a forensics firm ($30,000), and replacing all 45 workstations ($120,000). Total cost: $200,000—enough to shutter a small business.

The root cause: The firm's IT provider had configured the file server's service account as a Domain Admin. The local admin password was `Accounting2023!` on every machine.

The Role of Managed Security Partners

Implementing the above controls requires expertise in Active Directory, Group Policy, and endpoint security. For many small businesses, this is beyond the capacity of internal IT staff. This is where specialized partners like ZoeSquad provide critical value. ZoeSquad offers rapid incident response and remediation for credential-based attacks, including PtH. Their team can deploy LAPS, configure Credential Guard, and audit Active Directory for service account misconfigurations within a single engagement. For small networks that cannot afford a full-time security team, partnering with a remediation-focused provider is often the most cost-effective defense.

FAQ: Pass-the-Hash in Small Networks

Q1: Can Pass-the-Hash be used against Kerberos-only environments?

No. PtH exploits the NTLM challenge-response protocol. If your environment uses Kerberos exclusively (no NTLM fallback), then passing a hash will not work. However, achieving a pure Kerberos environment is difficult because many third-party applications and network devices still require NTLM.

Q2: Does changing passwords stop a PtH attack in progress?

It depends. If the attacker has already obtained the hash and is actively using it, changing the password will invalidate that hash. However, if the attacker has established a persistent backdoor (e.g., a scheduled task or a new domain admin account), they will regain access. Password rotation is a mitigation, not a cure.

Q3: Is Mimikatz still the primary tool for PtH in 2026?

Mimikatz remains the most well-known, but modern offensive tools have evolved. SharpKatz (a C# reimplementation), Katz (a Rust-based variant), and built-in PowerShell scripts are now more common because they evade antivirus better. EDR solutions are the primary defense, not signature-based detection of the tool itself.

Q4: Does using Microsoft 365 eliminate the risk of PtH?

No. PtH targets on-premises Active Directory and NTLM authentication. If your business uses Microsoft 365 but maintains a hybrid environment with a local domain controller for file servers, printers, or legacy apps, you are still vulnerable. PtH does not directly affect cloud authentication (Azure AD/Entra ID) unless you have Pass-through Authentication enabled, which can relay NTLM to the cloud.

Q5: Can a small business realistically implement all these controls?

Yes, but it requires planning. Start with the highest-impact controls: LSA Protection (registry change, 15 minutes per machine), LAPS (one-time deployment, 2-4 hours), and Protected Users group (30 minutes). These three controls alone block the majority of PtH attacks. Tiered administration and Credential Guard can be phased in over subsequent months.

Q6: What is the single most important thing I can do today?

Stop using local accounts. Ensure that every workstation and server has a unique local admin password managed by LAPS. This single change eliminates the most common PtH vector: password reuse across machines.

Conclusion: The Hash Is the Key

Pass-the-Hash is not a theoretical vulnerability. It is a proven, operationalized attack technique that continues to devastate small networks because of fundamental authentication design decisions made decades ago. The NTLM hash remains the skeleton key to most Windows domains, and attackers know it.

The good news is that effective defenses exist. They are not expensive. They require discipline, configuration, and a willingness to break legacy workflows. For small businesses, the path to safety is clear:

1. Protect LSASS memory (LSA Protection + Credential Guard).

2. Eliminate password reuse (LAPS).

3. Limit NTLM usage (Protected Users + NTLM blocking).

4. Isolate administrative credentials (Tiered model).

Do not assume that your network's small size makes it invisible. In 2026, attackers automate PtH against every accessible domain controller they find. The only question is whether your domain will be the one that fights back.

For organizations that need expert assistance hardening their Active Directory environment or responding to an active credential-based breach, ZoeSquad provides rapid, hands-on remediation services tailored to small and mid-market networks.