CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

ZeroLogon Netlogon privilege escalation, exploited during the 2020 to 2022 South Staffordshire Water intrusion (ICO enforcement, 2026-05-11)

cve · CVE-2020-1472

Coverage
1
first 2026-05-12 → last 2026-10-21
Latest activity
2026-05-12
ICO fines South Staffordshire £963,900: a 20-month phishing foothold, ZeroLogon on two DCs and only 5% of IT…
Peak priority
notable
1 notable
Targets
water
sectors: water, public-sector · regions: uk, europe
Sources cited
6
4 hosts

Defender insights

What each entry about CVE-2020-1472 tells a defender to do, newest first.

2026-05-12NOTABLEexploitedICO fines South Staffordshire £963,900: a 20-month phishing foothold, ZeroLogon on two DCs and only 5% of IT monitored

Exposure · detection

Story timeline

  1. 2026-05-12ICO fines South Staffordshire Water £963,900 under UK GDPR for the 2020 to 2022 intrusion: phishing foothold, ZeroLogon on two unpatched domain controllers, 5% of IT monitored
    active-threatsICO fines South Staffordshire £963,900: a 20-month phishing foothold, ZeroLogon on two DCs and only 5% of IT monitored

Hunting pivots

Affected products
Microsoft Windows Server
Tags
data-breachlaw-enforcementransomware
ATT&CK techniques (4 across 5 tactics)

4 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts: Domain Accounts · Phishing: Spearphishing Attachment
  • ExecutionUser Execution: Malicious File
  • PersistenceValid Accounts: Domain Accounts
  • Privilege EscalationExploitation for Privilege Escalation · Valid Accounts: Domain Accounts
  • StealthValid Accounts: Domain Accounts

Initial Access TA0001

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-05-12/ico-fines-south-staffordshire-water-963-900-water-sector-oes · ATT&CK page ↗

T1566.001Phishing: Spearphishing Attachment×1

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

Evidence: 2026-05-12/ico-fines-south-staffordshire-water-963-900-water-sector-oes · ATT&CK page ↗

Execution TA0002

T1204.002User Execution: Malicious File×1

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.

Evidence: 2026-05-12/ico-fines-south-staffordshire-water-963-900-water-sector-oes · ATT&CK page ↗

Persistence TA0003

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-05-12/ico-fines-south-staffordshire-water-963-900-water-sector-oes · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-05-12/ico-fines-south-staffordshire-water-963-900-water-sector-oes · ATT&CK page ↗

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-05-12/ico-fines-south-staffordshire-water-963-900-water-sector-oes · ATT&CK page ↗

Stealth TA0005

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-05-12/ico-fines-south-staffordshire-water-963-900-water-sector-oes · ATT&CK page ↗

Entries about ZeroLogon Netlogon privilege escalation, exploited during the 2020 to 2022 South Staffordshire Water intrusion (ICO enforcement, 2026-05-11) (1)

2026-05-12 · view entry permalink →

NOTABLECVE-2020-1472exploitedupdatedNATOA2

ICO fines South Staffordshire Water £963,900 under UK GDPR for the 2020 to 2022 intrusion: phishing foothold, ZeroLogon on two unpatched domain controllers, 5% of IT monitored

The UK Information Commissioner's Office fined South Staffordshire Plc and South Staffordshire Water Plc £963,900 for infringing Articles 5(1)(f) and 32(1) of the UK GDPR (ICO enforcement action), after a 40% reduction for the company's early admission, which it accepted without appeal (ICO, 2026-05-11). The attack began in September 2020 with a phishing email whose attachment, once opened, let the attacker install malicious software that stayed undetected for 20 months; in May 2022 the attacker moved through the network and compromised domain administrator privileges, and the breach was found only when IT performance problems started an internal investigation on 15 July 2022, followed by a ransom note on 26 July (ICO, 2026-05-11). Two domain controllers were unpatched against ZeroLogon (CVE-2020-1472) in May 2022, and while the incident did not start through it, the attacker exploited it during the incident (ICO penalty notice). The company held data on about 1.85 million customers, around 750,000 current and 1.1 million former, and on its staff; the personal data of 633,887 people was published on the dark web, part of over 4.1 TB of data, including online-service usernames and passwords, bank account numbers and sort codes, employees' National Insurance numbers and information from which disabilities of Priority Services Register customers could be inferred (ICO, 2026-05-11). The ICO does not name the attacker; The Record and The Register attribute the attack to Cl0p, which claimed it, and the penalty notice makes no reference to any compromise of operational or water-treatment systems (The Record, 2026-05-11; The Register, 2026-05-11).

In this case, the recipient opened an attachment which enabled the attacker to install malicious software which remained undetected within the organisation's systems for 20 months.

Inadequate monitoring and logging; only 5% of the IT environment was being monitored, meaning malicious activity was not detected.

UK ICO (press release) 2026-05-11

Endpoint telemetry and logging were not integrated into South Staffordshire’s security incident and event monitoring platform.

UK ICO (monetary penalty notice) 2026-05-07

Two domain controllers also remained unpatched against a critical vulnerability known as ZeroLogon which allows rapid escalation of privileges and was first published in August 2020. The attacker successfully exploited this vulnerability during the incident.

The penalty notice makes no reference to any compromise of operational or water treatment systems.

The Record 2026-05-11
Correctionrun 2026-10-21T1148Z-auditaffected_productsbodyclassificationcvesentitiesevidenceheadlineprioritysourcessourcing_notesummarytechniquestitle

The ICO itself names the vulnerability: two domain controllers were unpatched against ZeroLogon (CVE-2020-1472) in May 2022, and the attacker exploited it during the incident, although the incident did not start through it (ICO penalty notice); it is the Cl0p attribution that comes from The Record and The Register (The Record, 2026-05-11). The sequence was a phishing attachment opened in September 2020, malicious software undetected for 20 months, then movement through the network and domain-admin compromise from May 2022, with the breach found on 15 July 2022 (ICO, 2026-05-11). The monitoring gap was concrete: a third-party security operations centre covered 5% of the IT environment and endpoint telemetry was not in the SIEM (ICO penalty notice). The fine is a UK GDPR penalty under Articles 5(1)(f) and 32(1) (ICO enforcement action); the Cyber Security and Resilience Bill was still expected to be introduced to Parliament (The Record, 2026-05-11).

incident12 May 05:00Zmulti-sourceOpen finding →
Sources: UK ICO (press release) · The Record · The Register · UK ICO (monetary penalty notice) · UK ICO (enforcement action) · Microsoft Security Response Center (CVE-2020-1472)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • ico.org.uk3 (50%)
  • msrc.microsoft.com1 (17%)
  • therecord.media1 (17%)
  • theregister.com1 (17%)

External references

NVD · cve.org · CISA KEV

All cited sources (6)