Netlogon Vulnerability Exploited in the Wild – PATCH NOW!

Summary

Microsoft revealed that it is actively tracking threat actors exploiting the Zerologon vulnerability (CVE-2020-1472) in Netlogon, the protocol used by Windows systems to authenticate to a domain controller. The vulnerability could be exploited to manipulate Netlogon authentication procedures to impersonate a system on the network, disable Netlogon authentication security features, and change passwords on a domain controller’s Active Directory, effectively taking over the domain controller and the internal network.

Recommendations

The NJCCIC highly advises administrators apply the patch released in Microsoft’s August Patch Tuesday update as soon as possible after appropriate testing. Please review the previous NJCCIC alert on Zerologon for more information.