Ransomwarehigh
Vice Society leverages PrintNightmare in ransomware attacks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-1675 | Remote Code Execution in Microsoft Windows Print Spooler (PrintNightmare) | 7.8 | 85% | KEVRansomwarePoC | KEV |
| CVE-2021-34527 | PrintNightmare: Remote Code Execution in Microsoft Windows Print Spooler | 8.8 | 100% | KEVRansomwarePoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 6f191f598589b7708b1890d56b374b45c6eb41610d34f976f0b4cfde8d5731af | erved being associated with the attack. PrintNightmare DLL: 6f191f598589b7708b1890d56b374b45c6eb41610d34f976f0b4cfde8d5731af |
From the original article
10 min read at blog.talosintelligence.com
Another threat actor is actively exploiting the so-called PrintNightmare vulnerability (CVE-2021-1675 / CVE-2021-34527) in Windows' print spooler service to spread laterally across a victim's network as part of a recent ransomware attack, according to Cisco Talos Incident Response research.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.