Patchfirst

Vice Society: Profiling a Persistent Threat to the Education Sector

unit42.paloaltonetworks.com · Undated · Licence: TRAM repository license; underlying reports not cleared for redistribution

Read the original ↗

CVEs this report names

2 CVEs
  1. CVE-2021-34527Microsoft Windows Print Spooler Remote Code Execution Vulnerability
    Microsoft · WindowsKEVRansomwarePublic exploitHigh · 8.8T1059Command and Scripting InterpreterT1068Exploitation for Privilege Escalation4 reports
    99.8%Top 0.04%
    88.1priority
  2. CVE-2021-1675Microsoft Windows Print Spooler Remote Code Execution Vulnerability
    Microsoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1204.002Malicious FileT1059Command and Scripting Interpreter3 reports
    85.3%Top 0.28%
    86.1priority

Where it names them

CVE-2021-34527
Vice Society first surfaced in the summer of 2021, and in that time frame it was seen exploiting the CVE-2021-34527 (aka PrintNightmare) vulnerability as part of their attack chain.
Original (opens in a new tab) ↗
Internet-facing applications and systems vulnerabilities can be exploited, such as PrintNightmare (CVE-2021-1675) and (CVE-2021-34527), to gain initial access.
Original (opens in a new tab) ↗
Software vulnerabilities, such as PrintNightmare (CVE-2021-1675) and (CVE-2021-34527), may be exploited in an attempt to elevate privileges.
Original (opens in a new tab) ↗
Resources Threat Brief: Windows Print Spooler RCE Vulnerability (CVE-2021-34527 AKA PrintNightmare)Emerging Ransomware Groups: AvosLocker, Hive, HelloKitty, LockBit 2.0Threat Assessment: Zeppelin Ransomware#StopRansomware: Vice
Original (opens in a new tab) ↗
CVE-2021-1675
Internet-facing applications and systems vulnerabilities can be exploited, such as PrintNightmare (CVE-2021-1675) and (CVE-2021-34527), to gain initial access.
Original (opens in a new tab) ↗
Software vulnerabilities, such as PrintNightmare (CVE-2021-1675) and (CVE-2021-34527), may be exploited in an attempt to elevate privileges.
Original (opens in a new tab) ↗

Techniques drawn from this report

4 links, in kill-chain order

Initial Access Exploit Public-Facing Application T1190 for CVE-2021-34527

Labelled by dataset annotators

Internet-facing applications and systems vulnerabilities can be exploited, such as PrintNightmare (CVE-2021-1675) and (CVE-2021-34527), to gain initial access.
Original (opens in a new tab) ↗

Initial Access Exploit Public-Facing Application T1190 for CVE-2021-1675

Labelled by dataset annotators

Internet-facing applications and systems vulnerabilities can be exploited, such as PrintNightmare (CVE-2021-1675) and (CVE-2021-34527), to gain initial access.
Original (opens in a new tab) ↗

Privilege Escalation Exploitation for Privilege Escalation T1068 for CVE-2021-34527

AI mapping from the description

Software vulnerabilities, such as PrintNightmare (CVE-2021-1675) and (CVE-2021-34527), may be exploited in an attempt to elevate privileges.
Original (opens in a new tab) ↗

Privilege Escalation Exploitation for Privilege Escalation T1068 for CVE-2021-1675

Labelled by dataset annotators

Software vulnerabilities, such as PrintNightmare (CVE-2021-1675) and (CVE-2021-34527), may be exploited in an attempt to elevate privileges.
Original (opens in a new tab) ↗
↑ ↓ chooseEnter openEsc close