CVE-2020-1472

CVE-2020-1472, also known as the Zerologon vulnerability, is a critical-severity flaw in Microsoft's Netlogon Remote Protocol. The vulnerability allows attackers to gain administrative access to a Windows domain controller without any authentication, effectively giving them control over a network. This flaw was patched on August 11, 2020, but it has been exploited widely by threat actors, particularly in phishing attempts and ransomware attacks. The rapid adoption of the Zerologon vulnerability significantly increased the speed and efficiency of ransomware attacks in 2020. Specifically, it was used to obtain privileged access to Active Directory and CobaltStrike as the C2 framework. In particular, the RansomHub ransomware's attack chain includes exploiting this vulnerability. In one instance, the FBI found a forensic artifact (exp.exe) on a compromised system that likely exploited the Netlogon vulnerability and connected to a domain controller. Various organizations such as the FBI, CISA, CNMF, NCSC-UK, and others have observed APT groups exploiting this vulnerability along with other ones like the Microsoft Exchange memory corruption vulnerability (CVE-2020-0688). Rhysida actors, for example, leveraged external-facing remote services, the Zerologon vulnerability, and phishing campaigns to gain initial access and persistence within a network. Despite these threats, telemetry data from Vision One identified the Zerologon vulnerability as another potential access vector, further emphasizing its widespread use in cyber attacks.