CVE-2020-1472

CVE-2020-1472, also known as the "ZeroLogon" vulnerability, is a critical-severity flaw in Microsoft's Netlogon Remote Protocol. This vulnerability, which was patched on August 11, 2020, allows attackers to escalate privileges and gain administrative access to a Windows domain controller without any authentication. The exploitation of this flaw effectively grants threat actors control over a network, posing significant security risks. Throughout 2020, the ZeroLogon vulnerability was widely adopted by threat actors, significantly enhancing both the speed and efficiency of ransomware attacks. In multiple instances, it was used to obtain privileged access to Active Directory and CobaltStrike as the Command and Control (C2) framework. Notably, the RansomHub ransomware incorporated the exploitation of the ZeroLogon vulnerability into its attack chain. In one case, the FBI found a forensic artifact (exp.exe) on a compromised system that likely exploits the Netlogon vulnerability and connects to a domain controller. Threat actors have been observed exploiting the ZeroLogon vulnerability in various ways, including phishing attempts and impersonation of the domain controller. In one such instance, threat actors attempted to impersonate the domain controller by exploiting the ZeroLogon privilege escalation vulnerability. Telemetry data from Vision One also identified the ZeroLogon vulnerability as a potential access vector, further highlighting its widespread use in cyberattacks.