Technical intelligence and weaponization dossier for CVE-2020-1472. Documented exploitation across 6 active malware families totaling 3,023 analyzed telemetry samples.
| Vulnerability ID | CVE-2020-1472 |
|---|---|
| Common Name / Bulletin | Microsoft Active Directory Netlogon Elevation of Privilege (Zerologon) (MS-NRPC Security Advisory) |
| CWE Classification | CWE-327: Broken Cryptographic Algorithm in Netlogon AES-CFB8 |
| Affected Software & Versions | Microsoft Windows Server 2008 through Server 2019 |
| Technical Root Cause | Flaw in AES-CFB8 implementation in Netlogon protocol using fixed initialization vector (IV=0). Unauthenticated attackers could authenticate as Domain Controller and reset machine account passwords in seconds. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 6 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| qbot | Banking Trojan | 1,758 | QakBot (widely referenced as Qbot or Pinkslipbot) is an aggressive, modular banking trojan and malware loader that operated for over 16 years, emerging around 2... |
| trickbot | Trojan | 466 | TrickBot (often dubbed Trickloader or Totep) is one of the most prolific and dangerous modular trojans and enterprise access vectors in modern cybercrime histor... |
| black | Ransomware | 329 | Black (cataloged across threat telemetry as Ransom:Win32/Black, Ransomware.BlackMatter, and Trojan-Ransom.Win32.Black) is an aggressive double-extortion enterpr... |
| ryuk | Ransomware | 210 | Ryuk is one of the most destructive and lucrative enterprise ransomware families in cybersecurity history, first identified in August 2018 and operated by the R... |
| conti | Ransomware | 180 | Conti is arguably the most aggressive and professionally structured ransomware syndicate in cybersecurity history, operated by the Russian cybercrime group Wiza... |
| bazarloader | Loader | 80 | BazarLoader (also known in threat intelligence telemetry as BazarBackdoor, BazaLoader, and Trojan.BazarLoader) is a high-stealth, enterprise-focused malware loa... |
Threat intelligence confirms the following adversaries weaponize CVE-2020-1472 in enterprise intrusions and campaign toolkits:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2020-1472 in enterprise networks:
Windows Event Log Event ID 5829 (unsecure Netlogon connection allowed) and Event ID 4742 (computer account password reset for domain controller machine account).SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Ransomware Containment & Incident Response →