PrintNightmare

[MJ Shoer]

Please use this thread to discuss the PrintNightmare exploit and what steps you are taking to secure your business as well as your customers.

For ease of navigation and reference, here are the threat reports and posts that have come in to the Cyber Forum on this exploit:

CISA Offers New Mitigation for PrintNightmare Bug

Printnightmare 0-Day Can Be Used to Take Over Windows Domain Controllers

Researchers Leak PoC Exploit for a Critical Windows RCE Vulnerability

PrintNightmare, the zero-day hole in Windows – here’s what to do

What is everyone doing about PrintNightmare

 

[Dave Alton]

MJ,

Thanks for putting this here. So important for all of us to contribute to the overall security of everyone else. If anyone has any other suggestions would love to hear it.

Thanks,

Dave

 

[Will Thomas]

We are now seeing reports of at least four confirmed cybercriminal gangs leveraging PrintNightmare in the wild:

This includes
Magniber ransomware - https://www.crowdstrike.com/blog/magniber-ransomware-caught-using-printnightmare-vulnerability/
Vice Society ransomware - https://blog.talosintelligence.com/2021/08/vice-society-ransomware-printnightmare.html
BazarLoader (which leads to Conti ransomware) -

https://twitter.com/i/web/status/1421117403644186629

PurpleFox EK -

https://twitter.com/i/web/status/1420402020259926016

Plus FiveHands ransomware who said they are likely to use it - https://intel471.com/blog/ransomware-as-a-service-fivehands-printnightmare-babuk-conti

We are also monitoring for any mentions of APT groups actively exploiting the PrintNightmare vulnerabilities. There is currently a new wave of ProxyShell exploit attacks, which could in theory be combined with PrintNightmare for local privilege escalation (LPE) to SYSTEM level privileges.