Citrus Ransomware: tactics, techniques, procedures, and links to Toy Ghouls
Defense Impairment: weak access policies for security tools play into attackers’ hands
Credential Access: mimikatz, a keylogger, and extraction of credentials from files
Entenda a falha
A vulnerabilidade
CVE-2026-54121 (Certighost) is an authentication bypass in the Active Directory Certificate Services (AD CS) role. Citrus Ransomware used it to escalate privileges from a low-privileged contractor domain account. The attacker needs a domain account that can create machine accounts and request certificates, plus network reach to the certification authority and to a system they control. If it works, they get a certificate that lets them authenticate as the domain controller account. The article also says the group ran an exploit for CVE-2020-1337, which is in the Metasploit repository, but it does not describe that flaw, so this text does not either. The article gives no affected or fixed versions for either CVE.
Como funciona
The attacker first creates a machine account in Active Directory, using a name generated by a script. On behalf of that account, they ask the AD CS certification authority for a certificate based on the Machine template. The request carries attributes, including a cdc attribute that tells the CA which system to contact to verify the data. The attacker points it at a host they control, which returns forged data. The CA accepts it and issues a certificate with the requested parameters, including a domain controller name in the SubjectAlternativeName field. That certificate then lets the attacker authenticate as the domain controller account.
Por que é vulnerável
From the article, the CA lets the requester choose, through the cdc attribute, the system it asks to verify the certificate data. It then trusts what that system returns, so forged data is enough to get a certificate with chosen identity fields. The article does not explain why the flaw went unnoticed or what the fix changes.
Como foi descoberta
The articles do not say who found the flaws or how they were reported. Securelist (Kaspersky) learned of the exploitation while analyzing recent Citrus Ransomware incidents. In those incidents, Active Directory showed machine accounts with telltale names created by exploit scripts, and PowerShell logs showed the CVE-2020-1337 exploit being run.
PoC pública
The article says the Certighost exploit used by the attackers is published on GitHub, and that the CVE-2020-1337 exploit is in the Metasploit GitHub repository. Both are working exploits already used in real intrusions. The article gives no exact address for either, so none is listed. Since public exploits exist and are in active use, patching AD CS and the CVE-2020-1337 fix is urgent.
Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 08:17.
Linha do tempo
-
Citrus Ransomware: tactics, techniques, procedures, and links to Toy Ghouls
ler a análise desta fonte ocultar
Defense Impairment: weak access policies for security tools play into attackers’ hands
Credential Access: mimikatz, a keylogger, and extraction of credentials from files