Patchfirst

Vice Society leverages PrintNightmare in ransomware attacks

blog.talosintelligence.com · Undated · Licence: TRAM repository license; underlying reports not cleared for redistribution

Read the original ↗

CVEs this report names

2 CVEs
  1. CVE-2021-34527Microsoft Windows Print Spooler Remote Code Execution Vulnerability
    Microsoft · WindowsKEVRansomwarePublic exploitHigh · 8.8T1059Command and Scripting InterpreterT1068Exploitation for Privilege Escalation4 reports
    99.8%Top 0.04%
    88.1priority
  2. CVE-2021-1675Microsoft Windows Print Spooler Remote Code Execution Vulnerability
    Microsoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1204.002Malicious FileT1059Command and Scripting Interpreter3 reports
    85.3%Top 0.28%
    86.1priority

Where it names them

CVE-2021-34527
Joe Marshall, and Arnaud Zobec.Executive SummaryAnother threat actor is actively exploiting the so-called PrintNightmare vulnerability (CVE-2021-1675 / CVE-2021-34527) in Windows' print spooler service to spread laterally across a victim's network as part of a recent ransomware attack, according to Cisco Talos
Original (opens in a new tab) ↗
CVE-2021-1675
Brumaghin, Joe Marshall, and Arnaud Zobec.Executive SummaryAnother threat actor is actively exploiting the so-called PrintNightmare vulnerability (CVE-2021-1675 / CVE-2021-34527) in Windows' print spooler service to spread laterally across a victim's network as part of a recent ransomware attack, according to
Original (opens in a new tab) ↗

Techniques drawn from this report

2 links, in kill-chain order

Lateral Movement Exploitation of Remote Services T1210 for CVE-2021-34527

Labelled by dataset annotators

Joe Marshall, and Arnaud Zobec.Executive SummaryAnother threat actor is actively exploiting the so-called PrintNightmare vulnerability (CVE-2021-1675 / CVE-2021-34527) in Windows' print spooler service to spread laterally across a victim's network as part of a recent ransomware attack, according to Cisco Talos
Original (opens in a new tab) ↗

Lateral Movement Exploitation of Remote Services T1210 for CVE-2021-1675

Labelled by dataset annotators

Joe Marshall, and Arnaud Zobec.Executive SummaryAnother threat actor is actively exploiting the so-called PrintNightmare vulnerability (CVE-2021-1675 / CVE-2021-34527) in Windows' print spooler service to spread laterally across a victim's network as part of a recent ransomware attack, according to Cisco Talos
Original (opens in a new tab) ↗
↑ ↓ chooseEnter openEsc close