CVE-2021-34527

CVE-2021-34527, also known as PrintNightmare, is a software vulnerability that involves a flaw in software design or implementation. The exploitation process begins when a user clicks on a link which downloads a ZIP archive containing a malicious JScript (JS) downloader titled 'Stolen Images Evidence.js' or 'DDoS attack proof and instructions on how to fix it.js.' This JS file then contacts a URL on newly created domains to download BazarLoader, which subsequently downloads Cobalt Strike and a PowerShell script designed to exploit the PrintNightmare vulnerability. In addition to CVE-2021-34527, the exploitation of another vulnerability named Follina (CVE-2022-30190) has also been reported. While Russian threat actors have been known to exploit a set of similar vulnerabilities including PrintNightmare (CVE-2021-34527 and CVE-2021-1675), the recent discovery of the use of GooseEgg in Forest Blizzard operations marks a unique development in this landscape. This discovery had not been previously reported by security providers. The report suggests that these vulnerabilities are being exploited to gain unauthorized access to systems and potentially compromise sensitive information. As such, it is crucial for organizations to apply patches and updates promptly to mitigate the risk of exploitation. Increased vigilance is required to monitor for suspicious activity and potential indicators of compromise associated with these vulnerabilities.