Microsoft warns 'Zerologon' Windows Server bug being exploited by hackers

Microsoft has issued a warning that hackers are exploiting a Windows Server system vulnerability that provides access to an organisation's active directory domain controller.

The tech giant said it was actively tracking hackers using the 'Zerologon' bug, which it said had been incorporated into attacker playbooks.

Zerologon has appeared in downloadable forms on the internet since it was first spotted by Dutch security firm Secura on 14 September. It is an exploit of Netlogon, the protocol used by Windows systems to authenticate against a Windows Server running as a domain controller. With it, hackers can take over the domain controller and, in turn, a company's internal network.

The warning comes just days after the US Cybersecurity and Infrastructure Security Agency (CISA) issued a directive, urging government agencies to immediately apply the Windows Server August 2020 security update to all domain controllers by 21 September.

CISA said that the bug poses "an unacceptable risk" and requires "immediate action", rating it the highest possible score of 10.0 on the CVSS scale of severity.

"Microsoft is actively tracking threat actor activity using exploits for the CVE-2020-1472 Netlogon EoP vulnerability, dubbed Zerologon," the tech giant warned in a tweet. "We have observed attacks where public exploits have been incorporated into attacker playbooks.

"Microsoft 365 customers can refer to the threat analytics report we published in Microsoft Defender Security Center. The threat analytics report contains technical details, mitigations, and detection details designed to empower SecOps to detect and mitigate this threat."

Researchers have dubbed the vulnerability Zerologon as it allows hackers with minimal access to a network to login to its Active Directory simply by sending a string of zeros in messages that use the Netlogon protocol.

It's said to affect Windows Server versions from 2008 up to 2019.