Vice Society ransomware also exploits PrintNightmare flaws in its attack
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-1675 | Remote Code Execution in Microsoft Windows Print Spooler (PrintNightmare) CVE-2021-1675 is a code execution flaw in the Windows Print Spooler service affecting the listed Windows 10, 7, 8.1, RT 8.1 and Windows Server editions. It is triggered through print operations processed by the spooler, notably print driver handling; the public PoC demonstrates DLL injection into the spooler, allowing an attacker to run arbitrary code with the privileges of the spooler service, typically SYSTEM. Successful exploitation yields full system compromise: installing programs, viewing or deleting data, creating accounts, and lateral movement into domains, which is why it has been widely used as a ransomware entry vector. Any Windows system with the Print Spooler service enabled is exposed, and the service runs by default on servers, domain controllers, and most workstations. Exploitation is confirmed in the wild: a public PoC is available, the flaw was weaponized by the Magniber and Vice Society ransomware groups, it was added to CISA KEV on 2021-11-03 with known ransomware use, and Microsoft issued out-of-band fixes after it was being exploited in the wild. Do: Apply Microsoft's out-of-band security updates immediately on all affected Windows client and server systems (per CISA KEV required action), prioritizing domain controllers and print/file servers. As an interim mitigation, disable the Print Spooler service on hosts that do not need printing (e.g., domain controllers) and restrict RPC/network access to the spooler on systems that must keep it running. Check for compromise by looking for unexpected DLL or driver files loaded by the spooler, spoolsv.exe spawning unusual child processes, and ransomware indicators given documented Magniber and Vice Society abuse. | 7.8 | 86% | KEV ransomware PoC |
| masshundreds of millions of Windows endpoints and servers (Print Spooler runs by default across the 1B+ device Windows installed base) | |
| CVE-2021-34527 | PrintNightmare: Remote Code Execution in Microsoft Windows Print Spooler CVE-2021-34527, widely known as 'PrintNightmare', is a remote code execution flaw in the Microsoft Windows Print Spooler service, which improperly performs privileged file operations such as loading printer driver DLLs. An attacker with low-level access who can reach a machine's spooler, for example a domain user able to add a printer connection via Point and Print, can induce the SYSTEM-privileged service to load an attacker-controlled DLL with no user interaction required (CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N). Successful exploitation yields arbitrary code execution as SYSTEM, letting the attacker install programs, view, change or delete data, and create new accounts with full user rights, effectively achieving complete host compromise. The flaw affects all supported Windows client and server releases in the CISA data, Windows 10 from 1507 through 22H2, Windows 11, Windows RT 8.1, and Windows Server 2008, 2012 and 2016, wherever the Print Spooler service is running. Exploitation is confirmed in the wild: the bug was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, the FBI and CISA have warned of Russian actors exploiting it, and EPSS places the 30-day exploitation probability at 99.8%. Do: Install the July 2021 security updates immediately, released July 6, 2021 with additional updates on July 7 for Windows Server 2012, Windows Server 2016 and Windows 10 version 1607, and review KB5005010 for restricting installation of new printer drivers after applying the July 6 updates. Where patching is delayed, disable the Print Spooler service on hosts that do not need printing or restrict Point and Print, and verify that NoWarningNoElevationOnInstall and UpdatePromptSettings under HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint are set to 0 or not defined (these keys do not exist by default, which is the secure state; NoWarningNoElevationOnInstall = 1 makes the system vulnerable by design). Prioritize domain controllers and servers with exposed spoolers, and hunt… | 8.8 | 100% | KEV ransomware PoC ×3 |
| masshundreds of millions of Windows systems (order of magnitude 10^8) | |
| CVE-2021-36958 | A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. NVD description · AI analysis pending | 7.8 | 31% |
| — |
Full article669 words · extracted from securityaffairs.com · click to collapse
Another ransomware gang, the Vice Society ransomware operators, is using Windows print spooler PrintNightmare exploits in its attacks.
The Vice Society ransomware operators are actively exploiting Windows print spooler PrintNightmare vulnerability in their attacks against Windows servers.
The PrintNightmare flaws (tracked as (CVE-2021-1675, CVE-2021-34527, and CVE-2021-36958) reside in the Windows Print Spooler service, print drivers, and the Windows Point and Print feature.
An attacker can exploit these vulnerabilities for local privilege escalation (LPE) or remote code execution (RCE).
Microsoft issued security updates, between June and August, to address the above issues, it also implemented the same changes to the default Point and Print default behavior. Non-administrator users will no longer be able to do the following using Point and Print without an elevation of privilege to administrator:
- Install new printers using drivers on a remote computer or server
- Update existing printer drivers using drivers from remote computer or server
Microsoft recently published a security advisory to warn its customers of another remote code execution zero-vulnerability, tracked as CVE-2021-36958, that resides in the Windows Print Spooler component. A local attacker could exploit the vulnerability to gain SYSTEM privileges on vulnerable systems.
“A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.” reads the security advisory published by Microsoft. “The workaround for this vulnerability is stopping and disabling the Print Spooler service.”
The flaw received a CVSS score of 7.3, Microsoft said that the only workaround for this issue is to disable the Print Spooler service.
Cisco Talos experts discovered that the Vice Society ransomware operators are exploiting two PrintNightmare vulnerabilities (CVE-2021-1675 and CVE-2021-34527) to deploy a malicious DLL on target servers.
“Another threat actor is actively exploiting the so-called PrintNightmare vulnerability (CVE-2021-1675 / CVE-2021-34527) in Windows’ print spooler service to spread laterally across a victim’s network as part of a recent ransomware attack, according to Cisco Talos Incident Response research.” states the post published by Cisco Talos.
Vice Society ransomware has been active since June, it is considered by researchers a spin-off of the HelloKitty ransomware, the malware targets both Windows and Linux systems primarily belonging to small or midsize victims.
This group focuses on public school districts and other educational institutions, like other ransomware gangs it implements a double extortion model and publishes data stolen from the victims on a data leak site.
Talos experts published a list of the main interesting characteristics of the operations of the group:
- The use of utilities such as proxychains and impacket during the post-compromise phases of the attack lifecycle.
- The targeting of backups to prevent recovery following ransomware deployment.
- The degradation of ESXi servers used for virtualization in victim environments.
- The use of a DLL that takes advantage of the recently discovered PrintNightmare vulnerability for which Microsoft has previously released a security update.
- Attempts to bypass native Windows protections for credential theft and privilege escalation.
The gang quickly adapts its TTPs to exploit new vulnerabilities to avoid detection, for lateral movement, and to gain persistence on a victim’s network.
This week, CrowdStrike revealed to have recently observed a malicious activity associated with Magniber ransomware, a threat that has been active since 2017. In the recent wave of attacks, the threat actors attempted to trigger the PrintNighmare vulnerability on systems belonging to victims in South Korea.
“The use of the vulnerability known as PrintNightmare shows that adversaries are paying close attention and will quickly incorporate new tools that they find useful for various purposes during their attacks.” concludes Talos.
“Multiple distinct threat actors are now taking advantage of PrintNightmare, and this adoption will likely continue to increase as long as it is effective.”
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Windows)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/121110/cyber-crime/vice-society-ransomware-printnightmare-flaws.html