Printnightmare

PrintNightmare (CVE-2021-34527) is a significant vulnerability in the Windows Print Spooler service that allows an attacker to escalate privileges either locally or remotely by loading a malicious DLL which will be executed as SYSTEM. This flaw, potentially a new zero-day Microsoft vulnerability, enables any authenticated attacker to remotely execute code with SYSTEM privileges on any machine that has the Windows Print Spooler service enabled, which is the default setting. The exploitation of this vulnerability, along with another known as Follina (CVE-2022-30190), has been reported, highlighting the severity and widespread nature of these security risks. The Black Basta affiliates have exploited this vulnerability, among others, for privilege escalation. They've used credential scraping tools like Mimikatz, Zerologon, NoPac, and PrintNightmare. According to cybersecurity researchers, Black Basta affiliates also exploited ZeroLogon (CVE-2020-1472), NoPac (CVE-2021-42278 and CVE-2021-42287), and PrintNightmare vulnerabilities for local and Windows Active Domain privilege escalation. These exploits are part of their advanced intrusion techniques, which also include the QakBot banking Trojan. By September, they had breached over ninety networks using these methods. Black Basta's use of these vulnerabilities has significant implications, especially considering their employment of double extortion ransomware. Because ZeroLogon, PrintNightmare, and PetitPotam allow an attacker to obtain privileged access to Active Directory without credential harvesting or lateral movement, it significantly simplifies the ransomware attack path. As such, X-Force observed their use in multiple ransomware attacks. The group's ability to exploit known vulnerabilities such as ZeroLogon, NoPac, and PrintNightmare to escalate privileges within the network underscores the urgent need for robust cybersecurity measures to protect against these threats.