PetitPotam

Tool

Threat entity extracted from intelligence sources

Frequency

8

occurrences

First Seen

January 15, 2026

Last Seen

September 8, 2026

PetitPotam is a Windows NTLM relay attack technique that exploits the MS-EFSRPC interface to coerce a target to authenticate to an attacker-controlled service, enabling relay-based lateral movement and potential domain compromise without stolen credentials.

Overview

Recent Events

Relationships

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Related Clusters (7)

New PoC Exploit for NTLM Reflection Bypass Vulnerability on Windows Server

Jun 30·3 sources

Critical CVE-2026-62911 Exposes 22,000 Exchange Servers to Remote Code Execution

Sep 1·15 sources

Urgent Threat from NTLMv1 Exploitation via Rainbow Tables

2d ago·2 sources

Spring Ring: Coordinated Vishing Campaign Exploits Microsoft Teams

Aug 31·41 sources

Aur0ra Ransomware Group Uses SpaceX's Cursor AI in Cyber Attacks on Seven Firms

Aug 28·15 sources

1 / 2

Related Articles (8)

NTLMv1 DC Rainbow Tables: Domain Compromise

adscanpro.com·2d ago

21,000 Exchange Servers Exposed to Public PoC Exploit After Pwn2Own $200K Chain Demo

Tech.Yahoo·Sep 1

Vishing campaign abuses Microsoft Teams to give attackers a foothold in company networks

Helpnetsecurity·Sep 1

Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams

Unit42.Paloaltonetworks·Aug 31

Threat Actors Abuse Cursor Agent AI to Assist Ransomware Operations

Infosecurity-Magazine·Aug 28

1 / 2

Related Entities

Apt29 Cloaked Ursa Phishing Brute Force Data Breach Man-in-the-Middle Ransomware Zero-day Exploit Spring Ring Boss Scam Austria Germany