CVE

CVE-2020-1472

View on NVD ↗

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is ad

Exploitation IoCs 1

Domain rhysida-leak[.]onion

MITRE ATT&CK TTPs 4

T1078
Valid Accounts
Defense Evasion
 T1133
External Remote Services
Persistence
 T1484.001
Group Policy Modification
Defense Evasion
 T1566
Phishing
Initial Access

Source Articles

Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network
The state government of Berlin confirmed a ransomware attack and data exfiltration from its administrative network between August 7 and August 12, 2026, attributed to the Rhysida ransomware group. The attackers claimed to have stolen 5.79 terabytes of data, including personal information on over 12,000 individuals, and published a post on their darknet leak site on August 28. Despite the extortion attempt, Berlin has refused to pay the ransom. Forensic investigations are ongoing, and affected departments were isolated before being reconnected on August 23.
hacker-news Aug 28, 2026