IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Microsoft warns 'Zerologon' Windows Server bug being exploited by hackers

The tech giant is 'actively tracking' threat actors using the exploit to access domain controllers

Ones and zeros traveling towards darkness

Microsoft has issued a warning that hackers are exploiting a Windows Server system vulnerability that provides access to an organisation's active directory domain controller.

The tech giant said it was actively tracking hackers using the 'Zerologon' bug, which it said had been incorporated into attacker playbooks.

Zerologon has appeared in downloadable forms on the internet since it was first spotted by Dutch security firm Secura on 14 September. It is an exploit of Netlogon, the protocol used by Windows systems to authenticate against a Windows Server running as a domain controller. With it, hackers can take over the domain controller and, in turn, a company's internal network.

The warning comes just days after the US Cybersecurity and Infrastructure Security Agency (CISA) issued a directive, urging government agencies to immediately apply the Windows Server August 2020 security update to all domain controllers by 21 September.

CISA said that the bug poses "an unacceptable risk" and requires "immediate action", rating it the highest possible score of 10.0 on the CVSS scale of severity.

"Microsoft is actively tracking threat actor activity using exploits for the CVE-2020-1472 Netlogon EoP vulnerability, dubbed Zerologon," the tech giant warned in a tweet. "We have observed attacks where public exploits have been incorporated into attacker playbooks.

Related Resource

Finding the right ADC to manage hybrid application delivery

A guide to ADC for IT and DevOps applications

Download now

"Microsoft 365 customers can refer to the threat analytics report we published in Microsoft Defender Security Center. The threat analytics report contains technical details, mitigations, and detection details designed to empower SecOps to detect and mitigate this threat."

Researchers have dubbed the vulnerability Zerologon as it allows hackers with minimal access to a network to login to its Active Directory simply by sending a string of zeros in messages that use the Netlogon protocol.

It's said to affect Windows Server versions from 2008 up to 2019.

Featured Resources

What 2023 will mean for the industry

What do most IT decision makers really think will be the important trends and challenges in the coming year?

Free Download

2022 Magic quadrant for Security Information and Event Management (SIEM)

SIEM is evolving into a security platform with multiple features and deployment models

Free Download

IDC MarketScape: Worldwide unified endpoint management services

2022 vendor assessment

Free Download

Magic quadrant for application performance monitoring and observability

Enabling continuous updating of diverse & dynamic application environments

View Now

Most Popular

Dutch hacker steals data from virtually entire population of Austria
data breaches

Dutch hacker steals data from virtually entire population of Austria

26 Jan 2023
GTA V vulnerability exposes PC users to partial remote code execution attacks
vulnerability

GTA V vulnerability exposes PC users to partial remote code execution attacks

23 Jan 2023
European partners expect growth this year, here are three ways they will achieve it
Sponsored

European partners expect growth this year, here are three ways they will achieve it

17 Jan 2023