Security researchers have unveiled a new zero-click exploit named 'Win-DDoS' that can transform Microsoft Windows Domain Controllers (DCs) into a botnet capable of executing distributed denial-of-service (DDoS) attacks. The findings were presented by researchers from SafeBreach Labs at DEF CON 33 on August 11, 2025. With DDoS attacks having increased 56% year-over-year in late 2024, and Cloudflare reporting peak attack traffic of 7.3 Tbps this year, the implications of this discovery are significant. According to SafeBreach, 'We discovered a novel DDoS technique that could be used to create a malicious botnet leveraging public DCs,' highlighting the ease with which attackers can exploit these vulnerabilities without requiring user interaction or authentication.
The 'Win-DDoS' technique exploits the Lightweight Directory Access Protocol (LDAP) client in Windows, specifically targeting how LDAP referrals are processed. By sending crafted Remote Procedure Calls (RPC) to domain controllers, attackers can manipulate these referrals to direct traffic towards a victim server. This allows for a continuous flood of TCP traffic as the DCs chase the referrals, effectively overwhelming the target. The researchers identified several vulnerabilities, including CVE-2025-32724, which facilitates this exploitation by allowing uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS).
The discovery builds upon previous research into the LDAPNightmare vulnerability (CVE-2024-49113), prompting SafeBreach to explore additional DoS vulnerabilities in Windows Server. The researchers noted, 'The embedded trust in client-side components can be abused,' allowing attackers to exploit blind spots in DCs' handling of LDAP referrals. Consequently, the attack can occur without the need for malware or lateral movement within networks, raising alarm among security professionals who must now contend with these new exploitation techniques.
In response to the findings, the cybersecurity community is urging immediate action. Security teams are advised to patch affected systems promptly and implement network monitoring to detect unusual traffic patterns that may indicate exploitation attempts. Security vendors are expected to release updates addressing these vulnerabilities, with SafeBreach emphasizing the need for robust defensive measures. In their report, they stated, 'All without purchasing anything and without leaving a traceable footprint,' underscoring the potential for widespread abuse.
As organizations work to mitigate the risks presented by Win-DDoS, they are encouraged to review their security postures and ensure that systems are updated to the latest versions. Failure to address these vulnerabilities could lead to significant operational disruptions, with the average minute of downtime costing around $6,000 for small and midsize firms. Security experts recommend immediate engagement with vendor advisories to secure systems against this emerging threat.
