Microsoft: Iranian hackers are exploiting ZeroLogon flaw

The vulnerability can give the hackers full control over a target’s domain controller, resulting in a complete takeover

The MuddyWater cyber-espionage group, which has suspected ties to the Iranian government, is taking advantage of a critical Windows server flaw: the ZeroLogon vulnerability

Microsoft was the first to detect the breach, and its Threat Intelligence Center (MSTIC) says the attacks have been ongoing for at least two weeks.

"MSTIC has observed activity by the nation-state actor MERCURY using the CVE-2020-1472 exploit (ZeroLogon) in active campaigns over the last 2 weeks," Microsoft warned in a tweet. "We strongly recommend patching."

Common Vulnerability Scoring System rated the ZeroLogon bug, indexed as CVE-2020-1472, a 10 out of 10 severity score this year. The vulnerability affects the Netlogon Remote authentication protocol that Windows uses to verify a Windows Server running as a domain controller.

By exploiting this bug, a hacker can take over a target’s Windows domain to change passwords and execute potentially harmful commands. So far, the vulnerability has shown its impact on all systems running Windows Server 2008 R2 and later. 

The ZeroLogon vulnerability patch will occur in a two-phase rollout, according to Microsoft. The first phase involves installing Microsoft’s August 2020 security update, which blocks Windows Active Directory Domain controllers from using unsecured remote procedure call (RPC) communication and logs authentication requests from non-Windows devices. The temporary patch will allow affected devices’ admins to fix or replace their devices.

Windows plans to run the second phase during the first quarter 2021 release. “The DCs will be placed in enforcement mode, which requires all Windows and non-Windows devices to use secure remote procedure call (RPC) with Netlogon secure channel or to explicitly allow the account by adding an exception for any non-compliant device," Microsoft said in its advisory. 

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Recommended

Global ransom DDoS extortionists are retargeting companies
distributed denial of service (DDOS)

Global ransom DDoS extortionists are retargeting companies

22 Jan 2021
Best ransomware removal tools
ransomware

Best ransomware removal tools

22 Jan 2021
Hackers publish over 4,000 files stolen from SEPA in ransomware attack
Security

Hackers publish over 4,000 files stolen from SEPA in ransomware attack

22 Jan 2021
BEC scammers are using Google Forms to identify easy victims
phishing

BEC scammers are using Google Forms to identify easy victims

21 Jan 2021

Most Popular

School laptops sent by government arrive loaded with malware
malware

School laptops sent by government arrive loaded with malware

21 Jan 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

21 Jan 2021
How to recover deleted emails in Gmail
email delivery

How to recover deleted emails in Gmail

6 Jan 2021