Russian APT28 Group in New “GooseEgg” Hacking Campaign

CVE-2021-1675 is a code execution flaw in the Windows Print Spooler service affecting the listed Windows 10, 7, 8.1, RT 8.1 and Windows Server editions. It is triggered through print operations processed by the spooler, notably print driver handling; the public PoC demonstrates DLL injection into the spooler, allowing an attacker to run arbitrary code with the privileges of the spooler service, typically SYSTEM. Successful exploitation yields full system compromise: installing programs, viewing or deleting data, creating accounts, and lateral movement into domains, which is why it has been widely used as a ransomware entry vector. Any Windows system with the Print Spooler service enabled is exposed, and the service runs by default on servers, domain controllers, and most workstations. Exploitation is confirmed in the wild: a public PoC is available, the flaw was weaponized by the Magniber and Vice Society ransomware groups, it was added to CISA KEV on 2021-11-03 with known ransomware use, and Microsoft issued out-of-band fixes after it was being exploited in the wild.

Do: Apply Microsoft's out-of-band security updates immediately on all affected Windows client and server systems (per CISA KEV required action), prioritizing domain controllers and print/file servers. As an interim mitigation, disable the Print Spooler service on hosts that do not need printing (e.g., domain controllers) and restrict RPC/network access to the spooler on systems that must keep it running. Check for compromise by looking for unexpected DLL or driver files loaded by the spooler, spoolsv.exe spawning unusual child processes, and ransomware indicators given documented Magniber and Vice Society abuse.

CVE-2021-34527, widely known as 'PrintNightmare', is a remote code execution flaw in the Microsoft Windows Print Spooler service, which improperly performs privileged file operations such as loading printer driver DLLs. An attacker with low-level access who can reach a machine's spooler, for example a domain user able to add a printer connection via Point and Print, can induce the SYSTEM-privileged service to load an attacker-controlled DLL with no user interaction required (CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N). Successful exploitation yields arbitrary code execution as SYSTEM, letting the attacker install programs, view, change or delete data, and create new accounts with full user rights, effectively achieving complete host compromise. The flaw affects all supported Windows client and server releases in the CISA data, Windows 10 from 1507 through 22H2, Windows 11, Windows RT 8.1, and Windows Server 2008, 2012 and 2016, wherever the Print Spooler service is running. Exploitation is confirmed in the wild: the bug was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, the FBI and CISA have warned of Russian actors exploiting it, and EPSS places the 30-day exploitation probability at 99.8%.

Do: Install the July 2021 security updates immediately, released July 6, 2021 with additional updates on July 7 for Windows Server 2012, Windows Server 2016 and Windows 10 version 1607, and review KB5005010 for restricting installation of new printer drivers after applying the July 6 updates. Where patching is delayed, disable the Print Spooler service on hosts that do not need printing or restrict Point and Print, and verify that NoWarningNoElevationOnInstall and UpdatePromptSettings under HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint are set to 0 or not defined (these keys do not exist by default, which is the secure state; NoWarningNoElevationOnInstall = 1 makes the system vulnerable by design). Prioritize domain controllers and servers with exposed spoolers, and hunt…

CVE-2022-38028 is an elevation-of-privilege vulnerability (CVSS 3.1: 7.8) in the Microsoft Windows Print Spooler, the service that manages print jobs on Windows machines. An attacker who can already run low-privileged code on a vulnerable system can exploit the flaw locally, with no user interaction required, to escalate to SYSTEM privileges and take full control of the host (high confidentiality, integrity, and availability impact). It affects a broad set of Windows releases — Windows 10 builds 1507 through 21H2, Windows 11 22H2, Windows 8.1 and Windows RT 8.1, and Windows Server 2012, 2016, and 2019 — so most unpatched Windows estates are in scope. Exploitation is confirmed in the wild: CISA added the bug to the KEV catalog on 2024-04-23 (ransomware use unknown), and public reporting attributes active use to the Russia-linked APT28 group, whose custom 'GooseEgg' tool leverages this NSA-reported flaw to run payloads with elevated privileges; Microsoft shipped the fix in its April 2024 Patch Tuesday. EPSS is 14.9% (96th percentile), indicating elevated near-term exploitation risk on top of the already-observed APT28 activity.

Do: Apply Microsoft's security updates for the affected Windows releases (fixed in the April 2024 Patch Tuesday); as a KEV entry, CISA requires applying vendor mitigations or discontinuing use of unpatched versions. On servers where printing is not required, disabling the Print Spooler service removes the local attack path. Given confirmed APT28 use of the 'GooseEgg' exploit, hunt for related activity on unpatched hosts and prioritize patching endpoints belonging to organizations and users targeted by APT28.