Zerologon

Vulnerability updated 17 days ago (2024-09-20T19:00:55.381Z)
Download STIX
Preview STIX
Zerologon (CVE-2020-1472) is a critical elevation of privilege vulnerability within Microsoft’s Netlogon Remote Protocol. This flaw in software design or implementation allows attackers to bypass authentication mechanisms and alter computer passwords within a domain controller's Active Directory, thereby quickly escalating privileges to domain administrator levels. The vulnerability presents a privilege escalation condition when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller using the Netlogon Remote Protocol. This vulnerability was discovered and exploited by various threat actors in 2020. The Zerologon vulnerability was rapidly adopted by ransomware operators in Q4 of 2020, significantly increasing the speed and efficiency of their attacks. Cuba ransomware actors and Rhysida actors, among others, exploited ZeroLogon to gain administrator privileges. The RansomHub ransomware's attack chain also includes exploiting this vulnerability, as does that of other Russia-based Advanced Persistent Threats (APTs). These actors used Zerologon alongside other known vulnerabilities such as NoPac and PrintNightmare for privilege escalation within networks. Telemetry data from Vision One identified Zerologon as a potential access vector, observed in unrelated incidents as well. In recent attacks involving the growing RansomHub ransomware, attackers have exploited the Zerologon flaw to gain initial access to a victim's environment. Other affiliates, like Black Basta, have used credential scraping tools like Mimikatz, Zerologon, NoPac, and PrintNightmare for privilege escalation. Therefore, the Zerologon vulnerability represents a significant security concern that has been widely exploited by various malicious actors.
Description last updated: 2024-09-20T18:17:02.086Z
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.
Alias DescriptionVotes
CVE-2020-1472 is a possible alias for Zerologon. CVE-2020-1472, also known as the Zerologon vulnerability, is a critical-severity flaw in Microsoft's Netlogon Remote Protocol. The vulnerability allows attackers to gain administrative access to a Windows domain controller without any authentication, effectively giving them control over a network. T
9
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Vulnerability
Exploit
Windows
Ransomware
Phishing
Exploits
T1068
Cuba
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Malware
To see the evidence that has resulted in these malware associations, create a free account
Alias DescriptionAssociation TypeVotes
The Cuba Ransomware Malware is associated with Zerologon. The Cuba ransomware is a malicious software that first appeared on cybersecurity radars in late 2020 under the name "Tropical Scorpius." It is designed to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites without the user's knowledge. Once insiUnspecified
2
Associated Threat Actors
To see the evidence that has resulted in these threatActor associations, create a free account
Alias DescriptionAssociation TypeVotes
The Ransomhub Threat Actor is associated with Zerologon. RansomHub, an increasingly active threat actor in the cyber security landscape, has been identified as the group behind several high-profile ransomware attacks. The group uses advanced tools and techniques to bypass security defenses and execute their malicious activities. In particular, RansomHub'sUnspecified
2
The Rhysida Threat Actor is associated with Zerologon. Rhysida, a threat actor group known for its malicious activities, has been actively executing ransomware attacks since May 2023. The group is known for its use of various families of ransomware to aid in double extortion attacks, including BlackCat, Hello Kitty, Quantum Locker, Rhysida, Zeppelin — iUnspecified
2
Associated Vulnerabilities
To see the evidence that has resulted in these vulnerability associations, create a free account
Alias DescriptionAssociation TypeVotes
The Proxylogon Vulnerability is associated with Zerologon. ProxyLogon is a significant software vulnerability, specifically an SSRF (Server-Side Request Forgery) flaw in Microsoft Exchange Server, identified as CVE-2021-26855. This vulnerability allows attackers to bypass authentication mechanisms and impersonate users. Alongside ProxyShell vulnerabilities Unspecified
2
The Proxyshell Vulnerability is associated with Zerologon. ProxyShell is a significant software vulnerability affecting Microsoft Exchange email servers. The flaw lies in the design or implementation of the software, making it a potential target for attackers seeking to exploit system weaknesses. Since early 2021, various vulnerabilities including ProxyShelUnspecified
2
The Printnightmare Vulnerability is associated with Zerologon. PrintNightmare (CVE-2021-34527) is a significant vulnerability in the Windows Print Spooler service that allows an attacker to escalate privileges either locally or remotely by loading a malicious DLL which will be executed as SYSTEM. This flaw, potentially a new zero-day Microsoft vulnerability, enUnspecified
2
Source Document References
Information about the Zerologon Vulnerability was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
PreviewSource LinkCreatedAtTitle
Trend Micro
17 days ago
ESET
a month ago
CISA
a month ago
InfoSecurity-magazine
3 months ago
DARKReading
4 months ago
Flashpoint
4 months ago
DARKReading
5 months ago
CISA
5 months ago
CERT-EU
7 months ago
Securityaffairs
9 months ago
CERT-EU
9 months ago
Securityaffairs
10 months ago
CERT-EU
10 months ago
Securityaffairs
10 months ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
Securityaffairs
a year ago
CERT-EU
a year ago
CERT-EU
a year ago