CVE-2020-1472

CVE-2020-1472, also known as the ZeroLogon vulnerability, is a critical-severity privilege escalation flaw in Microsoft's Netlogon Remote Protocol. It was patched by Microsoft on August 11, 2020. This vulnerability allows attackers to gain administrative access to a Windows domain controller without any authentication, effectively giving them control over the network. The rapid adoption of ZeroLogon in 2020 significantly increased the speed and efficiency of ransomware attacks, enabling threat actors to obtain privileged access to Active Directory and use CobaltStrike as the C2 framework. The FBI, along with other security agencies like CISA, CNMF, and NCSC-UK, observed an APT group exploiting this vulnerability along with others like Microsoft Exchange memory corruption vulnerability (CVE-2020-0688) and Fortinet VPN vulnerability (CVE-2018-13379). In one instance, the FBI discovered a forensic artifact (exp.exe) on a compromised system that likely exploited the Netlogon vulnerability and connected to a domain controller. This allowed the threat actors to gain initial access and escalate privileges within the network using valid accounts. In recent attacks involving the growing RansomHub ransomware, attackers have exploited ZeroLogon to gain initial access to victims' environments. The threat actors have also been observed exploiting ZeroLogon in phishing attempts, leveraging external-facing remote services such as virtual private networks (VPNs) to gain initial access and persistence within a network. These activities highlight the ongoing risk posed by the CVE-2020-1472 vulnerability, underlining the importance of implementing patches and maintaining strong cybersecurity practices.