Loading story…
Kroll published detection guidance for CVE-2020-1472 (Zerologon), the critical Microsoft Netlogon flaw that allows attackers to compromise Active Directory domain controllers. The guidance followed Microsoft's advisory and focused on identifying whether attackers had already abused the bug in the wild, a risk highlighted by warnings from Microsoft, DHS, and the FBI, including reports of active exploitation by state-backed actors.
The detection playbook describes three common attack paths: resetting a domain controller computer-account password and leaving it changed, resetting it and later restoring the original password, and using a printer spooler plus NTLM relay technique that avoids a password reset entirely. Kroll said defenders should review Windows security events including 4624, 4742, and in some cases 5805, examine domain controller password-hash history for null-password resets or restored credentials, inspect LSASS memory with Yara-based methods, and use Snort or Suricata to spot scans and exploitation attempts on the network.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft's second-phase mitigation for CVE-2020-1472 began on 2021-02-09, enforcing secure RPC on all domain controllers regardless of the prior registry setting. The phase also changed logging behavior so insecure RPC connections were denied and logged as Event ID 5827, with only explicitly exempted devices allowed to continue.
Mimikatz release 2.2.0 #19041 added a module to scan for and exploit Zerologon, expanding public offensive tooling for the vulnerability.
DHS issued an urgent directive on September 18 requiring systems to be patched by September 21. The article also says the FBI and Microsoft warned of active exploitation, including against networks supporting election systems and by state-sponsored hackers.
Microsoft released the initial deployment-phase updates for CVE-2020-1472 on August 11, 2020, beginning phased enforcement of secure RPC for Netlogon secure channel connections. The updates added logging and temporary exception controls to identify and manage non-compliant devices before mandatory enforcement.
The Emerging Threats public Snort rules repository released a rule to detect Zerologon exploitation attempts by identifying repeated NetrServerAuthenticate requests with 0x00 client credentials.
Microsoft issued a patch for CVE-2020-1472, also known as Zerologon, a critical Active Directory domain controller vulnerability that can let an unauthenticated attacker gain the highest privileges in a domain.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
mnemonic.io
Open sourcekroll.com
Open sourceportal.msrc.microsoft.com
Open sourcesupport.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical Windows Netlogon remote code execution flaw, tracked as **`CVE-2026-41089`**, is being actively exploited against corporate networks, with attacks targeting Windows Server domain controllers. The vulnerability can be triggered through specially crafted Netlogon requests without authentication or user interaction, potentially allowing attackers to run arbitrary code with **SYSTEM-level privileges** and escalate to full domain compromise. Microsoft patched the issue in its May 2026 Patch Tuesday release, which addressed **118 vulnerabilities**, including **16 critical** flaws, and the **Centre for Cybersecurity Belgium** flagged the Netlogon bug as a priority because of confirmed in-the-wild exploitation. Organizations are being urged to immediately patch supported Windows Server versions from 2012 onward, restrict domain controllers from untrusted network exposure, and increase monitoring for suspicious Netlogon and authentication activity while reinforcing segmentation and access controls around domain controllers.
Jun 30, 2026
A China-linked espionage group tracked as **Cicada**/**APT10** exploited Microsoft’s **Zerologon** flaw, `CVE-2020-1472`, in a long-running campaign against major Japanese companies and some overseas subsidiaries, including entities in the United States. Researchers said the attackers used the bug to compromise domain controllers, steal domain credentials, and effectively seize control of **Active Directory** environments, enabling credential theft, network reconnaissance, data exfiltration, and persistent access across victim networks. The operation combined public exploit activity around Zerologon with a broader post-compromise toolkit that included **QuasarRAT**, the newly observed **Backdoor.Hartip**, DLL side-loading, and administrative utilities such as **WMIExec**, **Certutil**, and **PowerShell**. Separate honeypot telemetry also showed in-the-wild Zerologon exploitation against exposed internet systems, underscoring how quickly the vulnerability moved from disclosure to active abuse while APT10 leveraged distinctive tradecraft such as `CppHostCLR`-based .NET loader execution and **ConfuserEx** obfuscation.
Aug 15, 2026
Microsoft shipped a Windows 10 cumulative security update that turned on **Enforcement mode** for the Netlogon elevation-of-privilege flaw tracked as `CVE-2020-1472`, widely known as **Zerologon**. The update, released for Windows 10 versions 2004 and 20H2 as `KB4601319`, advanced Microsoft’s phased mitigation by requiring stricter Netlogon secure channel protections to address the critical Active Directory domain controller weakness. The same release also delivered broader security fixes across Windows Authentication, Cryptography, Virtualization, Core Networking, and Cloud Infrastructure, and addressed a `win32k` elevation-of-privilege issue. Microsoft said the update was distributed through Windows Update, recommended installing servicing stack update `KB4598481` first, and noted separate known issues involving Japanese IME Furigana behavior and a Discord Direct3D 12 overlay incompatibility.
Aug 14, 2026