Loading story…
A China-linked espionage group tracked as Cicada/APT10 exploited Microsoft’s Zerologon flaw, CVE-2020-1472, in a long-running campaign against major Japanese companies and some overseas subsidiaries, including entities in the United States. Researchers said the attackers used the bug to compromise domain controllers, steal domain credentials, and effectively seize control of Active Directory environments, enabling credential theft, network reconnaissance, data exfiltration, and persistent access across victim networks.
The operation combined public exploit activity around Zerologon with a broader post-compromise toolkit that included QuasarRAT, the newly observed Backdoor.Hartip, DLL side-loading, and administrative utilities such as WMIExec, Certutil, and PowerShell. Separate honeypot telemetry also showed in-the-wild Zerologon exploitation against exposed internet systems, underscoring how quickly the vulnerability moved from disclosure to active abuse while APT10 leveraged distinctive tradecraft such as CppHostCLR-based .NET loader execution and ConfuserEx obfuscation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
At 11:01 UTC on the reported day, IP address 124.70.137.246 attempted to exploit CVE-2020-1472 against the BluePot honeypot, triggering an Azure Sentinel alert. The source IP was identified via Shodan as belonging to Huawei Cloud Service.
Symantec said the Cicada espionage operation continued until the beginning of October 2020, with attackers remaining on some victim networks for close to a year. During the campaign, the group exploited Zerologon, compromised domain controllers and file servers, and deployed QuasarRAT and Backdoor.Hartip.
Microsoft disclosed and patched the Netlogon elevation-of-privilege flaw CVE-2020-1472, known as Zerologon. The bug could allow attackers to spoof a domain controller account, steal credentials, and fully compromise Active Directory.
Symantec reported that the China-linked Cicada/APT10 group began a large-scale espionage campaign targeting major Japanese companies and some subsidiaries, including locations in the United States. The operation involved credential theft, reconnaissance, persistence, and data exfiltration.
Symantec reported and attributed the long-running campaign against Japanese-linked organizations to the China-linked Cicada/APT10 group based on tooling and tradecraft, including DLL side-loading, a distinctive DLL export name, CppHostCLR-based loader execution, ConfuserEx obfuscation, and QuasarRAT delivery.
The DoublePulsar author said they detected an attacker exploiting Zerologon on a personal honeypot about three weeks before the later BluePot observation. This was cited as earlier evidence of in-the-wild exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
threatpost.com
Open sourcedoublepulsar.com
Open sourcesymantec-enterprise-blogs.security.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Chinese state-linked hacking group tracked as **APT10** was tied to a months-long supply-chain intrusion against Taiwan’s financial sector, compromising organizations through an undisclosed flaw in the web administration interface of a widely used securities software product. Researchers said the affected platform reportedly serves more than **80%** of Taiwan’s local financial organizations, giving the attackers broad downstream access. The campaign, tracked as **Operation Cache Panda**, was disguised in part as credential-stuffing activity while targeting brokerage data, personally identifiable information, and the ability to disrupt investment operations rather than steal funds directly. After initial access, the attackers uploaded the **ASPXCSharp** web shell to control exposed servers, used **Impacket** to scan internal networks, and moved laterally with **Remote Service** creation and **WMI**. They then deployed a **Quasar RAT** variant and other .NET payloads through reflective in-memory loading using tooling associated with **Donut** and **SharpSploit**, reducing on-disk artifacts and antivirus detection. Investigators also found the group established reverse-tunnel **RDP** access for persistent interactive control and used the Chinese cloud file-sharing service **WenShuShu** to retrieve tools during the operation.
Aug 15, 2026
Microsoft reported that a China-linked threat actor tracked as **DEV-0322** exploited **CVE-2021-40539** in vulnerable **Zoho ManageEngine ADSelfService Plus** servers to compromise organizations in the defense industrial base, higher education, consulting, and information technology sectors. The intrusions involved credential dumping, lateral movement, and the installation of a malicious **IIS** module that accepted commands through HTTP cookies, harvested authentication data into `key.dat`, and could deploy `ccc.exe` to run `cmd.exe` commands on infected systems. Additional reporting tied the activity to a broader post-exploitation toolset associated with **Godzilla**, **NGLite**, and **KdcSponge**, reinforcing that the attackers were focused on stealthy persistence and credential access after initial compromise. Microsoft also said the actor deployed **Trojan:Win64/Zebracon**, which used hardcoded credentials to access compromised **Zimbra** mail servers and retrieve commands through **SOAP** email operations, and published detections, hunting queries, and indicators of compromise to help defenders identify affected systems and follow-on activity.
Aug 15, 2026
Kroll published detection guidance for **CVE-2020-1472** (**Zerologon**), the critical Microsoft Netlogon flaw that allows attackers to compromise **Active Directory domain controllers**. The guidance followed Microsoft's advisory and focused on identifying whether attackers had already abused the bug in the wild, a risk highlighted by warnings from Microsoft, DHS, and the FBI, including reports of active exploitation by state-backed actors. The detection playbook describes three common attack paths: resetting a domain controller computer-account password and leaving it changed, resetting it and later restoring the original password, and using a **printer spooler plus NTLM relay** technique that avoids a password reset entirely. Kroll said defenders should review Windows security events including `4624`, `4742`, and in some cases `5805`, examine domain controller password-hash history for null-password resets or restored credentials, inspect **LSASS** memory with Yara-based methods, and use **Snort** or **Suricata** to spot scans and exploitation attempts on the network.
Aug 15, 2026