New Cybersecurity Threat: Win-DDoS Attack
Unveiling a Novel Attack Technique
Researchers at SafeBreach have recently introduced a groundbreaking method that could potentially enable cybercriminals to harness thousands of publicly available domain controllers (DCs) worldwide, turning them into a massive botnet capable of launching powerful distributed denial-of-service (DDoS) attacks. This technique, dubbed Win-DDoS, was presented at the DEF CON 33 security conference by researchers Or Yair and Shahak Morag.
The Mechanism Behind Win-DDoS
Yair and Morag reported that their investigation into the Windows LDAP client code revealed a significant vulnerability. This flaw allows attackers to cleverly manipulate URL referral processes, directing DCs to target a specific victim server, effectively overwhelming it. They explained the implications: "We could develop a technique that enables attackers to utilize the resources of countless public DCs globally, fabricating a malicious botnet capable of high upload rates—all without the need for financial expenditure or leaving any trace."
How the Attack Works
The attack’s execution is notably sophisticated yet straightforward:
- RPC Call Initiation: The attacker initiates a Remote Procedure Call (RPC) to the DCs, prompting them to act as CLDAP (Connectionless Lightweight Directory Access Protocol) clients.
- Referral Process: The DCs then send a CLDAP request to the attacker’s server. In response, they receive a referral that guides them to the attacker’s LDAP server, changing the communication protocol from UDP to TCP.
- LDAP Queries: The DCs subsequently query the LDAP server over TCP.
- Referral URL Response: The attacker’s LDAP server responds with a referral list, all pointing to the same IP address on a specific port.
- Repeated Queries: As the DCs attempt to connect, they generate a continuous flow of queries until all URLs are exhausted, thus executing the DDoS attack.
As Yair and Morag detailed, the process leads to a cascading effect where TCP connections are aborted, creating repeated queries that strain the target server.
The Significance of Win-DDoS
What sets Win-DDoS apart from previous DDoS techniques is its remarkable efficiency. The method boasts high bandwidth capabilities and removes the typical requirement for attackers to acquire dedicated infrastructure. Also, it eliminates the need for breaching devices, allowing attackers to launch attacks discreetly and with minimal risk of detection.
System Vulnerabilities Uncovered
Further exploration of the LDAP client code revealed additional concerns. Researchers identified potential to trigger critical system failures, including crashes of the Local Security Authority Subsystem Service (LSASS) and even causing blue screens of death (BSoD). The absence of limits on referral list sizes means that lengthy responses can lead to significant service interruptions.
Multiple new vulnerabilities were also discovered in the system:
- CVE-2025-26673 (CVSS score: 7.5): This flaw in Windows Lightweight Directory Access Protocol (LDAP) allows unauthorized attackers to deny service over the network. It was patched in May 2025.
- CVE-2025-32724 (CVSS score: 7.5): A similar vulnerability in LSASS, fixed in June 2025.
- CVE-2025-49716 (CVSS score: 7.5): This risk in Windows Netlogon was resolved in July 2025.
- CVE-2025-49722 (CVSS score: 5.7): Identified in the Windows Print Spooler, allowing authorized attackers to disrupt services over an adjacent network, also patched in July 2025.
These vulnerabilities echo previous concerns, like the LDAPNightmare vulnerability discovered earlier this year, exposing ongoing weaknesses that threaten organizational security.
Implications for Cybersecurity Strategies
The vulnerabilities detailed by the researchers raise critical questions about conventional cybersecurity assumptions. They highlight the overlooked risks associated with internal systems, underscoring that denial-of-service threats can occur beyond public-facing services. This insight demands a reassessment of risk models within enterprises, urging organizations to enhance their defense strategies comprehensively.
Yair and Morag’s findings assert that these vulnerabilities are zero-click and unauthenticated, enabling remote crashes if systems are publicly accessible. They emphasize the need for businesses to recognize potential vulnerabilities within their internal environments to bolster their cybersecurity resilience.
In conclusion, as the digital landscape evolves, so too do the threats that accompany it. Staying informed about emerging vulnerabilities and attack methods like Win-DDoS is essential for maintaining robust cybersecurity practices.
