Microsoft warns 'Zerologon' Windows Server bug being exploited by hackers
The tech giant is 'actively tracking' threat actors using the exploit to access domain controllers
Microsoft has issued a warning that hackers are exploiting a Windows Server system vulnerability that provides access to an organisation's active directory domain controller.
The tech giant said it was actively tracking hackers using the 'Zerologon' bug, which it said had been incorporated into attacker playbooks.
Zerologon has appeared in downloadable forms on the internet since it was first spotted by Dutch security firm Secura on 14 September. It is an exploit of Netlogon, the protocol used by Windows systems to authenticate against a Windows Server running as a domain controller. With it, hackers can take over the domain controller and, in turn, a company's internal network.
The warning comes just days after the US Cybersecurity and Infrastructure Security Agency (CISA) issued a directive, urging government agencies to immediately apply the Windows Server August 2020 security update to all domain controllers by 21 September.
CISA said that the bug poses "an unacceptable risk" and requires "immediate action", rating it the highest possible score of 10.0 on the CVSS scale of severity.
"Microsoft is actively tracking threat actor activity using exploits for the CVE-2020-1472 Netlogon EoP vulnerability, dubbed Zerologon," the tech giant warned in a tweet. "We have observed attacks where public exploits have been incorporated into attacker playbooks.
RELATED RESOURCE
Finding the right ADC to manage hybrid application delivery
A guide to ADC for IT and DevOps applications
"Microsoft 365 customers can refer to the threat analytics report we published in Microsoft Defender Security Center. The threat analytics report contains technical details, mitigations, and detection details designed to empower SecOps to detect and mitigate this threat."
Researchers have dubbed the vulnerability Zerologon as it allows hackers with minimal access to a network to login to its Active Directory simply by sending a string of zeros in messages that use the Netlogon protocol.
It's said to affect Windows Server versions from 2008 up to 2019.
-
Low-budget devices are the biggest casualty of the RAM crisisNews Say goodbye to budget devices; vendors are doubling down on high-end options to absorb costs
-
Sectigo taps Clint Maddox to lead global field operationsReviews The appointment follows a year of strong momentum for the security vendor as it expands its global channel footprint
-
Security agencies issue warning over critical Cisco Catalyst SD-WAN vulnerabilityNews Threat actors have been exploiting the vulnerability to achieve root access since 2023
-
Millions of developers could be impacted by flaws in Visual Studio Code extensions – here's what you need to know and how to protect yourselfNews The VS Code vulnerabilities highlight broader IDE security risks, said OX Security
-
CVEs are set to top 50,000 this year, marking a record high – here’s how CISOs and security teams can prepare for a looming onslaughtNews While the CVE figures might be daunting, they won't all be relevant to your organization
-
Microsoft patches six zero-days targeting Windows, Word, and more – here’s what you need to knowNews Patch Tuesday update targets large number of vulnerabilities already being used by attackers
-
Experts welcome EU-led alternative to MITRE's vulnerability tracking schemeNews The EU-led framework will reduce reliance on US-based MITRE vulnerability reporting database
-
Veeam patches Backup & Replication vulnerabilities, urges users to updateNews The vulnerabilities affect Veeam Backup & Replication 13.0.1.180 and all earlier version 13 builds – but not previous versions.
-
Two Fortinet vulnerabilities are being exploited in the wild – patch nowNews Arctic Wolf and Rapid7 said security teams should act immediately to mitigate the Fortinet vulnerabilities
-
Everything you need to know about Google and Apple’s emergency zero-day patchesNews A serious zero-day bug was spotted in Chrome systems that impacts Apple users too, forcing both companies to issue emergency patches
