Zerologon

Zerologon (CVE-2020-1472) is a critical vulnerability within Microsoft's Netlogon Remote Protocol that emerged in 2020. It involves a privilege escalation condition that allows an attacker to establish a vulnerable Netlogon secure channel connection to a domain controller, bypassing authentication mechanisms and changing computer passwords within the Active Directory. This flaw enables rapid escalation to domain administrator levels, increasing the speed and efficiency of attacks. Throughout 2020, Zerologon was rapidly adopted by various ransomware operators to obtain privileged access to Active Directory. Notably, Cuba ransomware actors exploited this vulnerability to gain administrator privileges. Similarly, Rhysida actors were also identified exploiting Zerologon. The RansomHub ransomware's attack chain included exploiting the Zerologon vulnerability, allowing attackers to gain initial access to a victim's environment. Despite its potency, not all attempts to exploit Zerologon were successful. In some cases, telemetry data from Vision One identified the Zerologon vulnerability as a potential access vector, but exploitation attempts were not always successful. Regardless, the discovery and subsequent use of Zerologon marked a significant shift in the landscape of cyber threats, highlighting the importance of robust software design and implementation to prevent such vulnerabilities.