Connect with us

Hi, what are you looking for?


Malware & Threats

Microsoft Says Hackers Continue to Target Zerologon Vulnerability

Microsoft this week revealed that it continues to receive reports from customers of attacks targeting the Zerologon vulnerability.

Microsoft this week revealed that it continues to receive reports from customers of attacks targeting the Zerologon vulnerability.

Patched on August 11, the security flaw was identified in the Microsoft Windows Netlogon Remote Protocol (MS-NRPC). Tracked as CVE-2020-1472, the issue can be exploited to compromise Active Directory domain controllers and gain domain administrator privileges.

The vulnerability came into the spotlight after the DHS ordered federal agencies to immediately apply available patches, with both Microsoft and CISA publishing information on attackers actively exploiting the bug.

At the end of September, Microsoft published a guide to provide organizations with all the necessary details for addressing the issue within their Active Directory deployments, but it appears that some customers continue to be vulnerable.

“If the original guidance is not applied, the vulnerability could allow an attacker to spoof a domain controller account that could be used to steal domain credentials and take over the domain,” Microsoft now says.

The tech giant also reiterates that the first step into addressing the vulnerability is installing the available patches on every domain controller.

“Once fully deployed, Active Directory domain controller and trust accounts will be protected alongside Windows domain-joined machine accounts. We strongly encourage anyone who has not applied the update to take this step now,” the company notes.

To ensure they are fully protected, customers should apply the update and follow Microsoft’s previously published guidance. The company has already updated the FAQs in that guidance, for further clarity.

Advertisement. Scroll to continue reading.

Following the update, customers are advised to identify any devices that might still be vulnerable, address them, and then enable enforcement mode, to ensure that CVE-2020-1472 is indeed addressed in their environment.

On Thursday, CISA published an alert to warn of the continuous exploitation of Zerologon and to urge administrators to apply the available patches as soon as possible.

Related: QNAP Issues Advisory on Zerologon Vulnerability

Related: Microsoft Warns of Russian Cybercriminals Exploiting Zerologon Vulnerability

Related: Zerologon Chained With Fortinet, MobileIron Vulnerabilities in U.S. Government Attacks

Related: Microsoft Says Iranian Hackers Exploiting Zerologon Vulnerability

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.


Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.