CISA/FBI Alert: Threat Actors Targeting Organizations Using Chained Exploits Including Zerologon (CVE-2020-1472)

Last week, the Cybersecurity Infrastructure Security Agency (CISA) issued a joint cybersecurity advisory with the Federal Bureau of Investigation (FBI) regarding activity associated with Advanced Persistent Threat (APT) groups. According to the alert, identified as AA20-283A, the attackers are targeting unpatched vulnerabilities across a number of products including:

• Pulse Connect Secure SSL VPN
• Fortinet FortiOS SSL VPN
• Citrix NetScaler
• Juniper Junos OS
• Palo Alto Networks PAN-OS
• F5 BIG-IP
• MobileIron

Most notable, however, is the increasing usage of “Zerologon,” a critical elevation of privilege vulnerability in Microsoft’s Netlogon identified as CVE-2020-1472.

According to CISA and the FBI, attackers are using vulnerability chaining or exploit chaining, gaining an initial foothold into their target environment via an unpatched vulnerability, and then elevating privileges using Zerologon.

For more information about the vulnerabilities, including the availability of patches and Tenable product coverage, please visit our blog.