Zerologon

Zerologon, officially known as CVE-2020-1472, is a critical vulnerability within Microsoft's Netlogon Remote Protocol. This flaw allows attackers to bypass authentication mechanisms and alter computer passwords within a domain controller's Active Directory, enabling them to escalate privileges to domain administrator levels rapidly. The vulnerability was notably exploited by ransomware operators in Q4 of 2020, significantly increasing the speed and efficiency of their attacks. Rhysida actors and Cuba ransomware actors were among those who exploited Zerologon to gain administrative privileges. RansomHub ransomware's attack chain notably included exploiting the Zerologon vulnerability for initial access to a victim's environment. The payload leveraged command-line tools to stop all Internet Information Services (IIS) services, further escalating the impact of the breach. In addition to RansomHub, other groups exploited known vulnerabilities like Zerologon, NoPac, and PrintNightmare to escalate privileges within networks. A Russia-based Advanced Persistent Threat (APT) also abused this tool in the infamous Zerologon campaign. Despite attempts to exploit the Zerologon vulnerability, some were unsuccessful. However, telemetry data from Vision One identified another potential access vector: the Zerologon vulnerability itself. This was observed in an unrelated incident, indicating the widespread risk posed by this flaw. With its ability to provide privileged access to Active Directory and be used in conjunction with other tools like CobaltStrike as the C2 framework, Zerologon poses a significant threat to cybersecurity.