Loading story…
Microsoft warned in October 2020 that Iranian nation-state actor MERCURY, also known as MuddyWater, Static Kitten and Seedworm, had actively exploited Zerologon (CVE-2020-1472) during the preceding two weeks. The critical flaw in Microsoft’s Netlogon Remote Protocol allows an unauthenticated attacker with network access to a domain controller to obtain domain administrator privileges and compromise Active Directory identity services. Microsoft did not identify MERCURY’s victims. A separate Microsoft analysis described an attack chain combining a SharePoint vulnerability, a web shell and Cobalt Strike with Zerologon attacks against domain controllers; it did not establish that this chain belonged to MERCURY.
Microsoft released initial fixes on August 11, 2020, but public exploit releases in September increased the risk and prompted an emergency federal patching directive. Remediation followed a two-phase rollout, with Netlogon secure-channel enforcement enabled by default in February 2021. Zerologon subsequently became a tool for nation-state actors and ransomware operators and entered known-exploited vulnerability tracking. Defenders should verify that domain controllers are fully patched, confirm secure-channel enforcement and address incompatible Netlogon connections rather than relying solely on the initial update.
See which actors are running it and whether you're in range.
20 events from the most recent confirmed update back to the earliest known activity.
Microsoft announced that it had observed MERCURY, also known as MuddyWater, Static Kitten and Seedworm, exploiting CVE-2020-1472 in active campaigns during the preceding two weeks. Microsoft did not disclose the victims.
Microsoft's activity graph showed Zerologon exploitation attempts by attackers and red teams beginning as early as September 13 and continuing thereafter.
Four proof-of-concept exploits for Zerologon were released publicly on GitHub, increasing the risk to unpatched Windows domain controllers.
MITRE and NVD metadata identify August 17, 2020, as the publication date for CVE-2020-1472, a critical Netlogon vulnerability that can allow unauthenticated attackers to obtain domain administrator access.
Microsoft released patches for CVE-2020-1472 in its August 11 Patch Tuesday updates, beginning a phased rollout to change how Windows handles Netlogon secure channels.
Fedora published package security announcements concerning CVE-2020-1472.
Ubuntu published security notices USN-4559-1, USN-4510-2 and USN-4510-1 addressing CVE-2020-1472.
Synology published security advisory Synology_SA_20_21 concerning CVE-2020-1472.
CERT/CC published vulnerability note VU#490028 for CVE-2020-1472.
Microsoft published guidance titled “How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472” to support its phased remediation rollout.
U.S. government agencies issued a joint cybersecurity advisory warning that advanced threat groups were chaining vulnerabilities to enter government networks and elevate privileges.
Microsoft described an attacker exploiting SharePoint flaw CVE-2019-0604, installing a web shell and deploying a Cobalt Strike-based payload before targeting domain controllers with Zerologon. The analysis did not explicitly attribute this attack chain to MERCURY.
Cisco Talos researchers warned of increased Zerologon exploitation attempts approximately one week before Microsoft's MERCURY alert.
Following public exploit releases, CISA issued Emergency Directive 20-04 requiring federal agencies to patch affected Windows Servers by September 21, 2020. The references do not specify the directive's issuance date.
Oracle's April 2021 Critical Patch Update included coverage for CVE-2020-1472. The overall update addressed 257 CVEs with 390 patches.
Microsoft released an additional Zerologon patch that enabled a protective security setting by default, implementing the second phase of its remediation rollout.
Debian LTS published an advisory addressing CVE-2020-1472.
The Samba Team released security versions 4.10.18, 4.11.13, and 4.12.7 and patches addressing CVE-2020-1472. The updates add server-side checks on client-supplied Netlogon challenges to mitigate the attack.
The Samba Team published an advisory confirming that certain Samba versions configured as domain controllers are vulnerable to CVE-2020-1472, extending the disclosed scope of Zerologon beyond Windows domain controllers.
openSUSE published security announcements addressing CVE-2020-1472.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
threatpost.com
Open sourcecyber.gc.ca
Open sourcetenable.com
Open sourcesamba.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kroll published detection guidance for **CVE-2020-1472** (**Zerologon**), the critical Microsoft Netlogon flaw that allows attackers to compromise **Active Directory domain controllers**. The guidance followed Microsoft's advisory and focused on identifying whether attackers had already abused the bug in the wild, a risk highlighted by warnings from Microsoft, DHS, and the FBI, including reports of active exploitation by state-backed actors. The detection playbook describes three common attack paths: resetting a domain controller computer-account password and leaving it changed, resetting it and later restoring the original password, and using a **printer spooler plus NTLM relay** technique that avoids a password reset entirely. Kroll said defenders should review Windows security events including `4624`, `4742`, and in some cases `5805`, examine domain controller password-hash history for null-password resets or restored credentials, inspect **LSASS** memory with Yara-based methods, and use **Snort** or **Suricata** to spot scans and exploitation attempts on the network.
Aug 21, 2026
A China-linked espionage group tracked as **Cicada**/**APT10** exploited Microsoft’s **Zerologon** flaw, `CVE-2020-1472`, in a long-running campaign against major Japanese companies and some overseas subsidiaries, including entities in the United States. Researchers said the attackers used the bug to compromise domain controllers, steal domain credentials, and effectively seize control of **Active Directory** environments, enabling credential theft, network reconnaissance, data exfiltration, and persistent access across victim networks. The operation combined public exploit activity around Zerologon with a broader post-compromise toolkit that included **QuasarRAT**, the newly observed **Backdoor.Hartip**, DLL side-loading, and administrative utilities such as **WMIExec**, **Certutil**, and **PowerShell**. Separate honeypot telemetry also showed in-the-wild Zerologon exploitation against exposed internet systems, underscoring how quickly the vulnerability moved from disclosure to active abuse while APT10 leveraged distinctive tradecraft such as `CppHostCLR`-based .NET loader execution and **ConfuserEx** obfuscation.
Aug 15, 2026
Attackers used BumbleBee malware in a May 2022 intrusion that escalated from a malicious ISO to domain administrator access. The DFIR Report linked initial delivery to a suspected contact-form campaign impersonating legal teams and alleging copyright infringement. The ISO contained a shortcut and DLL that initiated infection, after which attackers deployed Meterpreter and Cobalt Strike, bypassed User Account Control, dumped credentials, and moved laterally through SMB and remote services. Approximately 19 hours after initial access, they exploited Zerologon (`CVE-2020-1472`) against the primary domain controller and subsequently used pass-the-hash to operate as a member of Domain Admins. Responders evicted the attackers before further impact was observed, and no ransomware deployment was reported. However, Zerologon exploitation left the primary domain controller unable to authenticate users, disrupting authentication across the environment. The DFIR Report assessed the activity as a likely precursor to ransomware with medium confidence. The incident underscores the importance of remediating Zerologon, restricting privileged lateral movement, and detecting credential dumping. Monitoring should cover both malicious tooling and legitimate process-dumping utilities such as Microsoft Sysinternals ProcDump, whose documentation is included among the supporting references.
Oct 9, 2026