Zerologon

Zerologon (CVE-2020-1472) is a critical elevation of privilege vulnerability within Microsoft’s Netlogon Remote Protocol. This flaw in software design or implementation allows attackers to bypass authentication mechanisms and alter computer passwords within a domain controller's Active Directory, thereby quickly escalating privileges to domain administrator levels. The vulnerability presents a privilege escalation condition when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller using the Netlogon Remote Protocol. This vulnerability was discovered and exploited by various threat actors in 2020. The Zerologon vulnerability was rapidly adopted by ransomware operators in Q4 of 2020, significantly increasing the speed and efficiency of their attacks. Cuba ransomware actors and Rhysida actors, among others, exploited ZeroLogon to gain administrator privileges. The RansomHub ransomware's attack chain also includes exploiting this vulnerability, as does that of other Russia-based Advanced Persistent Threats (APTs). These actors used Zerologon alongside other known vulnerabilities such as NoPac and PrintNightmare for privilege escalation within networks. Telemetry data from Vision One identified Zerologon as a potential access vector, observed in unrelated incidents as well. In recent attacks involving the growing RansomHub ransomware, attackers have exploited the Zerologon flaw to gain initial access to a victim's environment. Other affiliates, like Black Basta, have used credential scraping tools like Mimikatz, Zerologon, NoPac, and PrintNightmare for privilege escalation. Therefore, the Zerologon vulnerability represents a significant security concern that has been widely exploited by various malicious actors.