CVE-2021-1675
published 2021-06-08CVE-2021-1675: Windows Print Spooler Remote Code Execution Vulnerability
PriorityP191high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2021-11-17
Exploited in the wild
EPSS
86.13%
99.7th percentile
Windows Print Spooler Remote Code Execution Vulnerability
Affected
84 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1507 | < 10.0.10240.18967 | 10.0.10240.18967 |
| microsoft | windows_10_1507 | < 10.0.10240.18969 | 10.0.10240.18969 |
| microsoft | windows_10_1607 | < 10.0.14393.4467 | 10.0.14393.4467 |
| microsoft | windows_10_1607 | < 10.0.14393.4470 | 10.0.14393.4470 |
| microsoft | windows_10_1809 | < 10.0.17763.1999 | 10.0.17763.1999 |
| microsoft | windows_10_1809 | < 10.0.17763.2029 | 10.0.17763.2029 |
| microsoft | windows_10_1909 | < 10.0.18363.1621 | 10.0.18363.1621 |
| microsoft | windows_10_2004 | < 10.0.19041.1052 | 10.0.19041.1052 |
| microsoft | windows_10_20h2 | < 10.0.19042.1052 | 10.0.19042.1052 |
| microsoft | windows_10_20h2 | < 10.0.19042.1083 | 10.0.19042.1083 |
| microsoft | windows_10_21h1 | < 10.0.19043.1052 | 10.0.19043.1052 |
| microsoft | windows_10_21h2 | < 10.0.19044.1415 | 10.0.19044.1415 |
| microsoft | windows_10_22h2 | < 10.0.19045.2251 | 10.0.19045.2251 |
| microsoft | windows_10_version_1507 | >= 10.0.0 < 10.0.10240.18967 | 10.0.10240.18967 |
| microsoft | windows_10_version_1507 | >= 10.0.0 < 10.0.10240.18969 | 10.0.10240.18969 |
| microsoft | windows_10_version_1607 | >= 10.0.0 < 10.0.14393.4467 | 10.0.14393.4467 |
| microsoft | windows_10_version_1607 | >= 10.0.0 < 10.0.14393.4470 | 10.0.14393.4470 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.1999 | 10.0.17763.1999 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.2029 | 10.0.17763.2029 |
| microsoft | windows_10_version_1909 | >= 10.0.0 < 10.0.18363.1621 | 10.0.18363.1621 |
| microsoft | windows_10_version_2004 | >= 10.0.0 < 10.0.19041.1052 | 10.0.19041.1052 |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < 10.0.19042.1052 | 10.0.19042.1052 |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < 10.0.19042.1083 | 10.0.19042.1083 |
| microsoft | windows_10_version_21h1 | >= 10.0.0 < 10.0.19043.1052 | 10.0.19043.1052 |
| microsoft | windows_10_version_21h2 | >= 10.0.0 < 10.0.19044.1415 | 10.0.19044.1415 |
Detection & IOCsextracted from sources · hover to see the quote
snort↗
57876
snort↗
57877
yara↗
Exploit.Win64.CVE-2021-1675.c
- →Monitor spoolsv.exe for loading DLLs from C:\Windows\System32\spool\drivers\x64\3\ — especially files named nightmare.dll or other unexpected DLL names — as this is the canonical drop path used by PrintNightmare exploits. ↗
- →Alert on spoolsv.exe spawning cmd.exe or whoami with SYSTEM integrity level, as this indicates successful PrintNightmare exploitation and code execution under SYSTEM privileges. ↗
- →Detect outbound network connections from spoolsv.exe, particularly to port 4444/TCP, which is the default Meterpreter callback port and was observed in active PrintNightmare exploitation. ↗
- →Monitor for registry modifications to \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\MSV1_0 following PrintNightmare exploitation, as attackers used this to force NTLMv1 authentication for hash interception. ↗
- →Detect use of certutil.exe to decode files into PE binaries (e.g., certutil -decode 1.txt <output.dll>) as a post-exploitation step observed after PrintNightmare compromise. ↗
- →Exploit code for PrintNightmare has been incorporated into Metasploit and Mimikatz; hunt for Mimikatz artifacts (VHO:Trojan-PSW.Win64.Mimikatz.gen) on hosts where spoolsv.exe showed anomalous behavior. ↗
- →The SharpPrintNightmare PoC uses the Microsoft Print System Asynchronous Remote Protocol (MS-PAR) as an alternative attack vector; network detection should cover both MS-RPRN and MS-PAR traffic to the print spooler. ↗
- →Presence of the PowerShell exploit script cve-2021-1675.ps1 (from the cve-2021-1675-main GitHub repository) on a host is a strong indicator of PrintNightmare exploitation attempt. ↗
- ·The July 2021 OOB patch for CVE-2021-34527 was bypassed within hours of release under certain conditions; patching alone is insufficient without also addressing Point and Print and printer driver installation policies. ↗
- ·Palo Alto NGFW Threat Prevention blocks PrintNightmare only when running Applications and Threat content update version 8427 or higher; earlier content versions will not block exploitation. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck7.8HIGH
cisa7.8HIGH
vendor_msrc8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Microsoft Windows Print Spooler Remote Code Execution Vulnerability
cisa·2021-11-03·CVSS 7.8
CVE-2021-1675 [HIGH] CWE-285 Microsoft Windows Print Spooler Remote Code Execution Vulnerability
Vulnerability: Microsoft Windows Print Spooler Remote Code Execution Vulnerability
Affected: Microsoft Windows
Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2021-1675
Remediation Due Date: 2021-11-17
Microsoft
Windows Print Spooler Remote Code Execution Vulnerability
vendor_msrc·2021-07-13·CVSS 8.8
CVE-2021-34527 [HIGH] Windows Print Spooler Remote Code Execution Vulnerability
Windows Print Spooler Remote Code Execution Vulnerability
Description: A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
UPDATE July 7, 2021: The security update for Windows Server 2012, Windows Server 2016 and Windows 10, Version 1607 have been released. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. If you are unable to install these updates, see the FAQ and Workaround sections in this CVE for inf
Microsoft
Windows Print Spooler Remote Code Execution Vulnerability
vendor_msrc·2021-06-08·CVSS 7.8
CVE-2021-1675 [HIGH] Windows Print Spooler Remote Code Execution Vulnerability
Windows Print Spooler Remote Code Execution Vulnerability
FAQ: Is this the vulnerability that has been referred to publicly as PrintNightmare?
No, Microsoft has assigned CVE-2021-34527 to PrintNightmare. CVE-2021-1675 is similar but distinct from CVE-2021-34527.
Windows Print Spooler Components: Windows Print Spooler Components
Microsoft: Microsoft
Impact: Remote Code Execution
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely;DOS:N/A
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5003646
Reference: https://support.microsoft.com/help/5003646
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5003635
Reference: https://support.microsoft.com
GHSA
GHSA-vwmm-qq95-vqhf: Windows Print Spooler Elevation of Privilege Vulnerability
ghsa_unreviewed·2022-05-24
CVE-2021-1675 [HIGH] CWE-269 GHSA-vwmm-qq95-vqhf: Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
VulnCheck
Microsoft Windows Print Spooler Remote Code Execution Vulnerability
vulncheck·2021·CVSS 7.8
CVE-2021-1675 [HIGH] CWE-285 Microsoft Windows Print Spooler Remote Code Execution Vulnerability
Microsoft Windows Print Spooler Remote Code Execution Vulnerability
Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.
Affected: Microsoft Windows
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://www.fortinet.com/blog/threat-research/affiliates-cookbook-firsthand-peek-into-operations-and-tradecraft-of-conti; https://blog.talosintelligence.com/2021/08/vice-society-ransomware-printnightmare.html; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://download.ahnlab.com/global/brochure/Analysis%20Report%20of%20Kimsuky%20Group.pdf; https://www.advintel.io/post/ransomware-advisory-log4shell-exploitation-for-initial-acc
Dfir Report
Inside the Open Directory of the “You Dun” Threat Group
blogs_dfir_report·2024-10-28
Inside the Open Directory of the “You Dun” Threat Group
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion Read More
- dragonforce Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs Read More
Services Overview
Threat Hunting
-
Integration
CTI Program Advisory
Incident Response Playbook
About us
Contact Us
Collaboration
Careers
Analysts
Access DFIR Labs
Get in Touch
Public Reports
Products Overview
Threat intel Overview
Threat Feed
Private DFIR Reports
All Intel
Active Defense
DFIR Labs
Case Artifacts
Detection Pack
AI Training Ground
Service Overview
Threat Hunting
Integration
CTI Program Advisory
Incident Response Playbook
Company Overview
About us
Contact Us
Careers
Analyst
SQL Brute Force Leads to BlueSky Ransomware
From OneNote to RansomNote: An Ice Col
Tenable
From Bugs to Breaches: 25 Significant CVEs As MITRE CVE Turns 25
blogs_tenable·2024-10-22
From Bugs to Breaches: 25 Significant CVEs As MITRE CVE Turns 25
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Microsoft
Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials
blogs_microsoft·2024-04-22·CVSS 8.8
[HIGH] Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials
Research
April 22, 2024
Hunt for JavaScript constrained file
DeviceFileEvents
| where TimeGenerated > ago(60d) // change the duration according to your requirement
| where ActionType == "FileCreated"
| where FolderPath startswith "C:\Windows\System32\DriverStore\FileRepository\"
| where FileName endswith ".js" or FileName == "MPDW-constraints.js"
Hunt for creation of registry key / value events
DeviceRegistryEvents
| where TimeGenerated > ago(60d) // change the duration according to your requirement
| where ActionType == "RegistryValueSet"
| where RegistryKey contains "HKEY_CURRENT_USER\Software\Classes\CLSID\{026CC6D7-34B2-33D5-B551-CA31EB6CE345}\Server"
| where RegistryValueName has "(Default)"
| where RegistryValueData has "wayzgoose.dll" or RegistryValueData contains ".dll"
Hunt
Tenable
Tenable Research Advisories: Urgent Action
blogs_tenable·2023-11-20
Tenable Research Advisories: Urgent Action
by Cesar Navas November 20, 2023
Tenable Research delivers world class exposure intelligence, data science insights, zero day research and security advisories. Our Security Response Team (SRT) in Tenable Research tracks threat and vulnerability intelligence feeds to make sure our research teams can deliver sensor coverage to our products as quickly as possible. The SRT also works to dig into technical details and author white papers, blogs, and additional communications to ensure stakeholders are fully informed of the latest cyber risks and threats. The SRT provides breakdowns for the latest critical vulnerabilities on the Tenable blog.
When security events rise to the level of taking immediate action, Tenable - leveraging SRT intelligence - notifies customers proactively to provide expo
Unit42
Vice Society: Profiling a Persistent Threat to the Education Sector
blogs_unit42·2022-12-06·CVSS 8.8
[HIGH] Vice Society: Profiling a Persistent Threat to the Education Sector
## Executive Summary
Vice Society is a ransomware gang that has been involved in high-profile activity against schools this year. Unlike many other ransomware groups such as LockBit that follow a typical ransomware-as-a-service (RaaS) model, Vice Society’s operations are different in that they’ve been known for using forks of pre-existing ransomware families in their attack chain that are sold on DarkWeb marketplaces. These include the HelloKitty (aka FiveHands) and Zeppelin strains of ransomware as opposed to Vice Society developing their own custom payload.
In September 2022, a joint Cybersecurity Advisory (CSA) from the FBI, CISA and the MS-ISAC declared they had recently observed Vice Society actors disproportionately targeting the education sector with ransomware attacks. The CSA co
Unit42
Vice Society: Profiling a Persistent Threat to the Education Sector
blogs_unit42·2022-12-06·CVSS 7.8
CVE-2021-1675 [HIGH] Vice Society: Profiling a Persistent Threat to the Education Sector
Threat Research Center
Threat Research
Ransomware
## Vice Society: Profiling a Persistent Threat to the Education Sector
JR Gumarin
Published: December 6, 2022
Ransomware
Threat Research
Vulnerabilities
CVE-2021-1675
CVE-2021-34527
HelloKitty
NGFW
PrintNightmare
Twinkling Scorpius
Vice Society
## Executive Summary
Vice Society is a ransomware gang that has been involved in high-profile activity against schools this year. Unlike many other ransomware groups such as LockBit that follow a typical ransomware-as-a-service (RaaS) model, Vice Society’s operations are different in that they’ve been known for using forks of pre-existing ransomware families in their attack chain that are sold on DarkWeb marketplaces. These include the HelloKitty (aka FiveHands) and Zeppelin stra
Sentinelone
Vice Society
blogs_sentinelone·2022-11-30
Vice Society
How It Works The Singularity XDR Difference
Singularity Marketplace One-Click Integrations to Unlock the Power of XDR
Pricing & Packaging Comparisons and Guidance at a Glance
Purple AI Accelerate SecOps with Generative AI
Singularity Hyperautomation Easily Automate Security Processes
AI-SIEM The AI SIEM for the Autonomous SOC
Singularity Data Lake AI-Powered, Unified Data Lake
Singularity Data Lake for Log Analytics Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
Singularity Endpoint Autonomous Prevention, Detection, and Response
Singularity XDR Native & Open Protection, Detection, and Response
Singularity RemoteOps Forensics Orchestrate Forensics at Scale
Singularity
Threat Intelligence Comprehensive Adversary Intelligence
Singularity Vulnerability Management
Tenable
ContiLeaks: Chats Reveal Over 30 Vulnerabilities Used by Conti Ransomware – How Tenable Can Help
blogs_tenable·2022-03-24
ContiLeaks: Chats Reveal Over 30 Vulnerabilities Used by Conti Ransomware – How Tenable Can Help
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
blogs_qualys·2022-02-23
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
#### Table of Contents
- Situation
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISA Vulnerabilities Using Qualys VMDR
- CISA Exploited RTI
- Detailed Operational Dashboard
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection & Response can be used by any organization to respond to this directive efficiently and effectively.
## Situation
Last November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directiv
Securelist
Attack techniques observed by Kaspersky MDR
blogs_securelist·2021-12-15·CVSS 7.8
[HIGH] Attack techniques observed by Kaspersky MDR
Table of Contents
- PrintNightmare vulnerability exploitation
- MuddyWater attack
- Credential Dumping from LSASS Memory
- Conclusion
Authors
- Petr Mareichev
- Sergey Soldatov
Kaspersky Managed Detection and Response (MDR) provides advanced protection against the growing number of threats that bypass automatic security barriers. Its capabilities are backed by a high-professional team of security analysts operating all over the world. Each suspicious security event is validated by our analysts complementing the automatic detection logic and letting us continuously improve the detection rules.
The MDR results allow us to map out the modern threat landscape and show techniques used by attackers right now. We share these results with you so that you are more informed about in-the-wild a
Securelist
Kaspersky Managed Detection and Response: interesting cases
blogs_securelist·2021-12-15·CVSS 7.8
[HIGH] Kaspersky Managed Detection and Response: interesting cases
Table of Contents
PrintNightmare vulnerability exploitation
Case #1
Case #2
MuddyWater attack
Credential Dumping from LSASS Memory
Conclusion
Authors
Petr Mareichev
Sergey Soldatov
Kaspersky Managed Detection and Response (MDR) provides advanced protection against the growing number of threats that bypass automatic security barriers. Its capabilities are backed by a high-professional team of security analysts operating all over the world. Each suspicious security event is validated by our analysts complementing the automatic detection logic and letting us continuously improve the detection rules.
The MDR results allow us to map out the modern threat landscape and show techniques used by attackers right now. We share these results with you so that you are more informed about in-t
Securelist
IT threat evolution Q3 2021
blogs_securelist·2021-11-26
IT threat evolution Q3 2021
Table of Contents
- Targeted attacks
- Other malware
Authors
- David Emm
- IT threat evolution Q3 2021
- IT threat evolution in Q3 2021. PC statistics
- IT threat evolution in Q3 2021. Mobile statistics
## Targeted attacks
### WildPressure targets macOS
Last March, we reported a WildPressure campaign targeting industrial-related entities in the Middle East. While tracking this threat actor in spring 2021, we discovered a newer version. It contains the C++ Milum Trojan, a corresponding VBScript variant and a set of modules that include an orchestrator and three plugins. This confirms our previous assumption that there were more last-stagers besides the C++ ones.
Another language used by WildPressure is Python. The PyInstaller module for Windows contains a script named “Guard”. Inter
Securelist
IT threat evolution in Q3 2021. PC statistics
blogs_securelist·2021-11-26
IT threat evolution in Q3 2021. PC statistics
Table of Contents
Quarterly figures
Financial threats
Financial threat statistics
Ransomware programs
Quarterly trends and highlights
Attack on Kaseya and the REvil story
The arrival of BlackMatter: DarkSide restored?
Q3 closures
Exploitation of vulnerabilities and new attack methods
Number of new ransomware modifications
Number of users attacked by ransomware Trojans
Geography of ransomware attacks
Top 10 most common families of ransomware Trojans
Miners
Number of new miner modifications
Number of users attacked by miners
Geography of miner attacks
Vulnerable applications used by cybercriminals during cyberattacks
Quarter highlights
Statistics
Attacks on macOS
Geography of threats for macOS
IoT attacks
IoT threat statistics
Attacks via web resources
Countries tha
Securelist
IT threat evolution in Q3 2021. PC statistics
blogs_securelist·2021-11-26
IT threat evolution in Q3 2021. PC statistics
Table of Contents
- Quarterly figures
- Financial threats
- Ransomware programs
- Number of users attacked by ransomware Trojans
- Geography of ransomware attacks
- Top 10 most common families of ransomware Trojans
- Miners
- Vulnerable applications used by cybercriminals during cyberattacks
- Attacks on macOS
- IoT attacks
- Attacks via web resources
- Local threats
Authors
- AMR
- IT threat evolution Q3 2021
- IT threat evolution in Q3 2021. PC statistics
- IT threat evolution in Q3 2021. Mobile statistics
These statistics are based on detection verdicts of Kaspersky products received from users who consented to providing statistical data.
## Quarterly figures
According to Kaspersky Security Network, in Q3 2021:
- Kaspersky solutions blocked 1,098,968,315 attacks from online reso
Securelist
IT threat evolution Q3 2021
blogs_securelist·2021-11-26·CVSS 8.8
CVE-2021-40444 [HIGH] IT threat evolution Q3 2021
Table of Contents
Targeted attacks
WildPressure targets macOS
LuminousMoth: sweeping attacks for the chosen few
Targeted attacks exploiting CVE-2021-40444
Tomiris backdoor linked to SolarWinds attack
GhostEmperor
FinSpy: analysis of current capabilities
Other malware
REvil attack on MSPs and their customers worldwide
What a [Print]Nightmare
Grandoreiro and Melcoz arrests
Gamers beware
Triada Trojan in WhatsApp mod
Qakbot banking Trojan
Authors
David Emm
IT threat evolution Q3 2021
IT threat evolution in Q3 2021. PC statistics
IT threat evolution in Q3 2021. Mobile statistics
## Targeted attacks
## WildPressure targets macOS
Last March, we reported a WildPressure campaign targeting industrial-related entities in the Middle East . While tracking this threat actor in spr
Qualys
Qualys Response to CISA Alert: Binding Operational Directive 22-01
blogs_qualys·2021-11-09
Qualys Response to CISA Alert: Binding Operational Directive 22-01
## Table of Contents
Overview
Directive Scope
CISA Catalog of Known Exploited Vulnerabilities
Detect CISAs Vulnerabilities Using Qualys VMDR
Remediation
Federal Enterprises and Agencies Can Act Now
Summary
Getting Started
Start your VMDR 30-day, no-cost trial today
## Overview
On November 3, 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directive 22-01 , “Reducing the Significant Risk of Known Exploited Vulnerabilities.” This directive recommends urgent and prioritized remediation of the vulnerabilities that adversaries are actively exploiting. It establishes a CISA-managed catalog of known exploited vulnerabilities that carry significant risk to the federal government and establishes requirements for agencies to remediate
Qualys
Qualys Response to CISA Alert: Binding Operational Directive 22-01 | Qualys
blogs_qualys·2021-11-09
Qualys Response to CISA Alert: Binding Operational Directive 22-01 | Qualys
#### Table of Contents
- Overview
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISAs Vulnerabilities Using Qualys VMDR
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
Start your VMDR 30-day, no-cost trial today
## Overview
On November 3, 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directive 22-01, “Reducing the Significant Risk of Known Exploited Vulnerabilities.” This directive recommends urgent and prioritized remediation of the vulnerabilities that adversaries are actively exploiting. It establishes a CISA-managed catalog of known exploited vulnerabilities that carry significant risk to the federal government and establishes requirements for agencies to
Tenable
Microsoft’s September 2021 Patch Tuesday Addresses 60 CVEs (CVE-2021-40444)
blogs_tenable·2021-09-14·CVSS 8.8
[HIGH] Microsoft’s September 2021 Patch Tuesday Addresses 60 CVEs (CVE-2021-40444)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Threat Source newsletter (Aug. 19, 2021)
blogs_talos·2021-08-19
Threat Source newsletter (Aug. 19, 2021)
Good afternoon, Talos readers.
I'm writing this on Tuesday morning on account of vacation (again), so apologies if we miss any major stories.
You certainly don't want to miss our latest blog post on the Neurevt remote access trojan that's targeting users in Mexico. This malware is mainly designed to steal login credentials to banking websites, and we don't really need to tell you why that would be bad.
## Upcoming Talos public engagements
CTIR on the Technado podcast
Speaker: Chris DiSalle
Date: Sept. 9
Location: Virtual
Description: Chris DiSalle from Talos Incident Response will join the Technado podcast to share the ins and outs of the IR industry. Chris will talk to host Don Pezet about how he got started in incident response, horror stories he's seen in the field, and much mor
Talos
Threat Source newsletter (Aug. 19, 2021)
blogs_talos·2021-08-19
Threat Source newsletter (Aug. 19, 2021)
## Threat Source newsletter (Aug. 19, 2021)
Good afternoon, Talos readers.
I'm writing this on Tuesday morning on account of vacation (again), so apologies if we miss any major stories.
You certainly don't want to miss our latest blog post on the Neurevt remote access trojan that's targeting users in Mexico. This malware is mainly designed to steal login credentials to banking websites, and we don't really need to tell you why that would be bad.
## Upcoming Talos public engagements
CTIR on the Technado podcast
Speaker: Chris DiSalle
Date: Sept. 9
Location: Virtual
Description: Chris DiSalle from Talos Incident Response will join the Technado podcast to share the ins and outs of the IR industry. Chris will talk to host Don Pezet about how he got started in incident response, horror
Tenable
The PrintNightmare Continues: Another Zero-Day in Print Spooler Awaits Patch (CVE-2021-36958)
blogs_tenable·2021-08-19·CVSS 7.8
[HIGH] The PrintNightmare Continues: Another Zero-Day in Print Spooler Awaits Patch (CVE-2021-36958)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Trendmicro
Detecting PrintNightmare Exploit Attempts using Trend Micro Vision One and Cloud One
blogs_trendmicro·2021-08-12·CVSS 7.8
[HIGH] Detecting PrintNightmare Exploit Attempts using Trend Micro Vision One and Cloud One
## Detecting PrintNightmare Exploit Attempts using Trend Micro Vision One and Cloud One
We look into the different implementations of PrintNightmare and include recommendations on how security teams can safeguard their workloads.
By: Trend Micro Aug 12, 2021 Read time: ( words)
Save to Folio
Update as of August 18, 2:54 a.m. EDT: We updated the section "Trend Micro Vision One™ Hunting Queries" (search queries) to include the latest indicators. Specifically, Figures 21 and 25 address events for the latest PrintNightmare implementation under CVE-2021-36958.
PrintNightmare is one of the latest set of exploits abused for the Print Spooler vulnerabilities that have been identified as CVE-2021-1675 , CVE-2021-34527 , CVE-2021-34481 , and CVE-2021-36958 . It is a code execution vulnerability
Trendmicro
Detecting PrintNightmare Exploit Attempts using Trend Micro Vision One and Cloud One
blogs_trendmicro·2021-08-12·CVSS 7.8
[HIGH] Detecting PrintNightmare Exploit Attempts using Trend Micro Vision One and Cloud One
## Detecting PrintNightmare Exploit Attempts using Trend Micro Vision One and Cloud One
We look into the different implementations of PrintNightmare and include recommendations on how security teams can safeguard their workloads.
By: Trend Micro 2021/08/12 Read time: ( words)
Save to Folio
Update as of August 18, 2:54 a.m. EDT: We updated the section "Trend Micro Vision One™ Hunting Queries" (search queries) to include the latest indicators. Specifically, Figures 21 and 25 address events for the latest PrintNightmare implementation under CVE-2021-36958.
PrintNightmare is one of the latest set of exploits abused for the Print Spooler vulnerabilities that have been identified as CVE-2021-1675 , CVE-2021-34527 , CVE-2021-34481 , and CVE-2021-36958 . It is a code execution vulnerability (
Trendmicro
Detecting PrintNightmare Exploit Attempts using Trend Micro Vision One and Cloud One
blogs_trendmicro·2021-08-12·CVSS 7.8
[HIGH] Detecting PrintNightmare Exploit Attempts using Trend Micro Vision One and Cloud One
# Detecting PrintNightmare Exploit Attempts using Trend Micro Vision One and Cloud One
We look into the different implementations of PrintNightmare and include recommendations on how security teams can safeguard their workloads.
By: Trend Micro
2021/08/12
Read time: ( words)
Save to Folio
Update as of August 18, 2:54 a.m. EDT: We updated the section "Trend Micro Vision One™ Hunting Queries" (search queries) to include the latest indicators. Specifically, Figures 21 and 25 address events for the latest PrintNightmare implementation under CVE-2021-36958.
PrintNightmare is one of the latest set of exploits abused for the Print Spooler vulnerabilities that have been identified as CVE-2021-1675, CVE-2021-34527, CVE-2021-34481, and CVE-2021-36958. It is a code execution vulnerability (both
Securelist
IT threat evolution in Q2 2021. PC statistics
blogs_securelist·2021-08-12
IT threat evolution in Q2 2021. PC statistics
Table of Contents
Quarterly figures
Financial threats
Financial threat statistics
Ransomware programs
Quarterly trends and highlights
Attack on Colonial Pipeline and closure of DarkSide
Closure of Avaddon
Clash with Clop
Attacks on NAS devices
Number of new ransomware modifications
Number of users attacked by ransomware Trojans
Geography of ransomware attacks
Top 10 most common families of ransomware Trojans
Miners
Number of new miner modifications
Number of users attacked by miners
Geography of miner attacks
Vulnerable applications used by cybercriminals during cyberattacks
Attacks on macOS
Geography of threats for macOS
IoT attacks
IoT threat statistics
Attacks via web resources
Countries that serve as sources of web-based attacks: Top 10
Countries where users fa
Talos
Vice Society leverages PrintNightmare in ransomware attacks
blogs_talos·2021-08-12·CVSS 7.8
CVE-2021-1675 [HIGH] Vice Society leverages PrintNightmare in ransomware attacks
## Executive Summary
Another threat actor is actively exploiting the so-called PrintNightmarevulnerability (CVE-2021-1675 / CVE-2021-34527) in Windows' print spooler service to spread laterally across a victim's network as part of a recent ransomware attack, according to Cisco Talos Incident Response research. While previous research found that other threat actors had been exploiting this vulnerability, this appears to be new for the threat actor Vice Society.
Talos Incident Response's research demonstrates that multiple, distinct threat actors view this vulnerability as attractive to use during their attacks and may indicate that this vulnerability will continue to see more widespread adoption and incorporation by various adversaries moving forward. For defenders, it is important to und
Trendmicro
Detecting PrintNightmare Exploit Attempts using Trend Micro Vision One and Cloud One
blogs_trendmicro·2021-08-12·CVSS 7.8
[HIGH] Detecting PrintNightmare Exploit Attempts using Trend Micro Vision One and Cloud One
## Detecting PrintNightmare Exploit Attempts using Trend Micro Vision One and Cloud One
We look into the different implementations of PrintNightmare and include recommendations on how security teams can safeguard their workloads.
By: Trend Micro Aug 12, 2021 Read time: ( words)
Save to Folio
Update as of 18 August, 2:54 a.m. EDT: We updated the section "Trend Micro Vision One™ Hunting Queries" (search queries) to include the latest indicators. Specifically, Figures 21 and 25 address events for the latest PrintNightmare implementation under CVE-2021-36958.
PrintNightmare is one of the latest set of exploits abused for the Print Spooler vulnerabilities that have been identified as CVE-2021-1675 , CVE-2021-34527 , CVE-2021-34481 , and CVE-2021-36958 . It is a code execution vulnerability
Talos
Vice Society leverages PrintNightmare in ransomware attacks
blogs_talos·2021-08-12·CVSS 7.8
CVE-2021-1675 [HIGH] Vice Society leverages PrintNightmare in ransomware attacks
## Vice Society leverages PrintNightmare in ransomware attacks
## Executive Summary
Another threat actor is actively exploiting the so-called PrintNightmare vulnerability (CVE-2021-1675 / CVE-2021-34527) in Windows' print spooler service to spread laterally across a victim's network as part of a recent ransomware attack, according to Cisco Talos Incident Response research. While previous research found that other threat actors had been exploiting this vulnerability , this appears to be new for the threat actor Vice Society.
Talos Incident Response's research demonstrates that multiple, distinct threat actors view this vulnerability as attractive to use during their attacks and may indicate that this vulnerability will continue to see more widespread adoption and incorporation by various
Securelist
IT threat evolution in Q2 2021. PC statistics
blogs_securelist·2021-08-12
IT threat evolution in Q2 2021. PC statistics
Table of Contents
- Quarterly figures
- Financial threats
- Ransomware programs
- Miners
- Vulnerable applications used by cybercriminals during cyberattacks
- Attacks on macOS
- IoT attacks
- Attacks via web resources
- Local threats
Authors
- AMR
These statistics are based on detection verdicts of Kaspersky products received from users who consented to providing statistical data.
## Quarterly figures
According to Kaspersky Security Network, in Q2 2021:
- Kaspersky solutions blocked 1,686,025,551 attacks from online resources across the globe.
- Web antivirus recognized 675,832,360 unique URLs as malicious.
- Attempts to run malware for stealing money from online bank accounts were stopped on the computers of 119,252 unique users.
- Ransomware attacks were defeated on the computers
Tenable
One Year Later: What Can We Learn from Zerologon?
blogs_tenable·2021-08-11
One Year Later: What Can We Learn from Zerologon?
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Fortinet
The Affiliate’s Cookbook - A Firsthand Peek into the Operations and Tradecraft of Conti
blogs_fortinet·2021-08-10
The Affiliate’s Cookbook - A Firsthand Peek into the Operations and Tradecraft of Conti
FORTIGUARD LABS THREAT RESEARCH
The Affiliate’s Cookbook - A Firsthand Peek into the Operations and Tradecraft of Conti
By Val Saengphaibul | August 10, 2021
FortiGuard Labs Threat Research Report
Ransomware has dominated the media headlines for the first half of 2021. The attack on Colonial Pipeline (Darkside) caused a disruption in the distribution of oil and gasoline across the East coast on the United States (ironically, it was the billing system taken offline and not OT devices controlling the supply). The one on JBS Foods in Brazil (REvil) led to concerns about a potential global meat shortage. And the one that targeted managed service provider Kaseya VSA (REvil) was a supply chain attack which resulted in downstream customers being impacted with ransomware attacks.
Prior to thes
Tenable
Microsoft’s August 2021 Patch Tuesday Addresses 44 CVEs (CVE-2021-26424, CVE-2021-36948)
blogs_tenable·2021-08-10·CVSS 9.9
[CRITICAL] Microsoft’s August 2021 Patch Tuesday Addresses 44 CVEs (CVE-2021-26424, CVE-2021-36948)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Unit42
Threat Brief: Windows Print Spooler RCE Vulnerability (CVE-2021-34527 AKA PrintNightmare)
blogs_unit42·2021-07-14·CVSS 7.8
CVE-2021-34527 [HIGH] Threat Brief: Windows Print Spooler RCE Vulnerability (CVE-2021-34527 AKA PrintNightmare)
## Executive Summary
On July 1, 2021, Microsoft released a security advisory for a new remote code execution (RCE) vulnerability in Windows, CVE-2021-34527, referred to publicly as "PrintNightmare.” Security researchers initially believed this vulnerability to be tied to CVE-2021-1675 (Windows Print Spooler Remote Code Execution Vulnerability), which was first disclosed in the Microsoft Patch Tuesday release on June 8, 2021. Microsoft has since updated the FAQ section of the advisory that shows CVE-2021-34527 is similar but distinct from CVE-2021-1675, which addresses a different but related vulnerability in RpcAddPrinterDriverEx().
## Systems Vulnerable to CVE-2021-34527
All Windows versions are affected by this vulnerability. Domain controllers, clients and member servers running the
Unit42
Threat Brief: Windows Print Spooler RCE Vulnerability (CVE-2021-34527 AKA PrintNightmare)
blogs_unit42·2021-07-14·CVSS 7.8
CVE-2021-34527 [HIGH] Threat Brief: Windows Print Spooler RCE Vulnerability (CVE-2021-34527 AKA PrintNightmare)
Threat Research Center
High Profile Threats
Vulnerabilities
## Threat Brief: Windows Print Spooler RCE Vulnerability (CVE-2021-34527 AKA PrintNightmare)
Unit 42
Published: July 14, 2021
High Profile Threats
Vulnerabilities
CVE-2021-1675
CVE-2021-34527
PrintNightmare
Remote Code Execution
Windows
## Executive Summary
On July 1, 2021, Microsoft released a security advisory for a new remote code execution (RCE) vulnerability in Windows, CVE-2021-34527, referred to publicly as "PrintNightmare.” Security researchers initially believed this vulnerability to be tied to CVE-2021-1675 (Windows Print Spooler Remote Code Execution Vulnerability), which was first disclosed in the Microsoft Patch Tuesday release on June 8, 2021. Microsoft has since updated the FAQ section of the advis
Sentinelone
PrintNightmare Vulnerability: Analysis and Mitigation
blogs_sentinelone·2021-07-14·CVSS 7.8
CVE-2021-34527 [HIGH] PrintNightmare Vulnerability: Analysis and Mitigation
## Executive Summary
- A remote code execution vulnerability is being dubbed ‘PrintNightmare’ (CVE-2021-34527 and CVE-2021-1675).
- The vulnerabilities are present in the Windows Spooler Service present on all Windows versions.
- Microsoft has released two patches to address these vulnerabilities (an Out-of_Band update on July 1 as well as the July 13th monthly update).
- Exploit code is readily available and has already been folded into popular hacking tools like Mimikatz and the Metasploit framework.
- SentinelOne has provided DeepVisibility queries to detect attempts to exploit PrintNightmare in customer environments.
## What Happened?
On June 29, 2021, details emerged of a remotely exploitable vulnerability in the Microsoft Windows Print Spooler service affecting all versions of Win
Sentinelone
PrintNightmare Vulnerability: Analysis and Mitigation
blogs_sentinelone·2021-07-14·CVSS 7.8
CVE-2021-34527 [HIGH] PrintNightmare Vulnerability: Analysis and Mitigation
## Executive Summary
A remote code execution vulnerability is being dubbed ‘PrintNightmare’ (CVE-2021-34527 and CVE-2021-1675).
The vulnerabilities are present in the Windows Spooler Service present on all Windows versions.
Microsoft has released two patches to address these vulnerabilities (an Out-of_Band update on July 1 as well as the July 13th monthly update).
Exploit code is readily available and has already been folded into popular hacking tools like Mimikatz and the Metasploit framework.
SentinelOne has provided DeepVisibility queries to detect attempts to exploit PrintNightmare in customer environments.
## What Happened?
On June 29, 2021, details emerged of a remotely exploitable vulnerability in the Microsoft Windows Print Spooler service affecting all versions of Windows t
Tenable
PrintNightmare
blogs_tenable·2021-07-13·CVSS 7.8
CVE-2021-34527 [HIGH] PrintNightmare
by Cody Dumont July 13, 2021
On July 6, Microsoft updated its advisory to announce the availability of out-of-band patches for a critical vulnerability in its Windows Print Spooler that researchers are calling PrintNightmare. Microsoft originally released its advisory for CVE-2021-34527 on July 1. This advisory was released in response to public reports about a proof-of-concept (PoC) exploit for CVE-2021-1675, a similar vulnerability in the Windows Print Spooler. To help clear up confusion about the vulnerability, Microsoft updated its advisory for CVE-2021-1675 to clarify that it is “similar but distinct from CVE-2021-34527.” This remote code execution (RCE) vulnerability affects all versions of Microsoft Windows.
CVE-2021-34527 is an RCE vulnerability in the Windows Print Spooler Servi
Tenable
PrintNightmare
blogs_tenable·2021-07-13·CVSS 7.8
CVE-2021-34527 [HIGH] PrintNightmare
by Josef Weiss July 13, 2021
On July 6, Microsoft updated its advisory to announce the availability of out-of-band patches for a critical vulnerability in its Windows Print Spooler that researchers are calling PrintNightmare. Microsoft originally released its advisory for CVE-2021-34527 on July 1. This advisory was released in response to public reports about a proof-of-concept (PoC) exploit for CVE-2021-1675, a similar vulnerability in the Windows Print Spooler. To help clear up confusion about the vulnerability, Microsoft updated its advisory for CVE-2021-1675 to clarify that it is “similar but distinct from CVE-2021-34527.” This remote code execution (RCE) vulnerability affects all versions of Microsoft Windows.
CVE-2021-34527 is an RCE vulnerability in the Windows Print Spooler Servi
Talos
PrintNightmare: Here’s what you need to know and Talos’ coverage
blogs_talos·2021-07-08·CVSS 7.8
CVE-2021-1675 [HIGH] PrintNightmare: Here’s what you need to know and Talos’ coverage
Over the past several weeks, there's been a lot of discussion about a particular privilege escalation vulnerability in Windows affecting the print spooler, dubbed PrintNightmare. The vulnerability (CVE-2021-1675/CVE-2021-34527) has now been patched multiple times but is believed to still be exploitable.
The vulnerability itself is a privilege escalation bug found in the print spooler service on Windows platforms. It was believed to allow authenticated users to achieve escalated privileges, including admin rights. The vulnerability's severity was complicated by the fact that, if triggered, the vulnerability could affect domain controllers in enterprise networks. To make matters worse, this privilege escalation vulnerability can be used to achieve remote code execution. This can be done by
Securelist
Quick look at CVE-2021-1675 & CVE-2021-34527 (aka PrintNightmare)
blogs_securelist·2021-07-08·CVSS 7.8
CVE-2021-1675 [HIGH] Quick look at CVE-2021-1675 & CVE-2021-34527 (aka PrintNightmare)
Table of Contents
- Summary
- Technical details
- Mitigations
Authors
- Kaspersky
## Recent vulnerabilities in Windows Print Spooler service
## Summary
Last week Microsoft warned Windows users about vulnerabilities in the Windows Print Spooler service – CVE-2021-1675 and CVE-2021-34527 (also known as PrintNightmare). Both vulnerabilities can be used by an attacker with a regular user account to take control of a vulnerable server or client machine that runs the Windows Print Spooler service. This service is enabled by default on all Windows clients and servers, including domain controllers.
Kaspersky products protect against attacks leveraging these vulnerabilities. The following detection names are used:
- HEUR:Exploit.Win32.CVE-2021-1675.*
- HEUR:Exploit.Win32.CVE-2021-34527.*
-
Securelist
Quick look at CVE-2021-1675 & CVE-2021-34527 (aka PrintNightmare)
blogs_securelist·2021-07-08·CVSS 7.8
CVE-2021-34527 [HIGH] Quick look at CVE-2021-1675 & CVE-2021-34527 (aka PrintNightmare)
Table of Contents
Summary
Technical details
CVE-2021-34527
CVE-2021-1675
Mitigations
Authors
Kaspersky
## Recent vulnerabilities in Windows Print Spooler service
## Summary
Last week Microsoft warned Windows users about vulnerabilities in the Windows Print Spooler service – CVE-2021-1675 and CVE-2021-34527 (also known as PrintNightmare). Both vulnerabilities can be used by an attacker with a regular user account to take control of a vulnerable server or client machine that runs the Windows Print Spooler service. This service is enabled by default on all Windows clients and servers, including domain controllers.
Kaspersky products protect against attacks leveraging these vulnerabilities. The following detection names are used:
HEUR:Exploit.Win32.CVE-2021-1675.*
HEUR:Exploit.Win
Talos
PrintNightmare: Here’s what you need to know and Talos’ coverage
blogs_talos·2021-07-08·CVSS 7.8
CVE-2021-1675 [HIGH] PrintNightmare: Here’s what you need to know and Talos’ coverage
## PrintNightmare: Here’s what you need to know and Talos’ coverage
Over the past several weeks, there's been a lot of discussion about a particular privilege escalation vulnerability in Windows affecting the print spooler, dubbed PrintNightmare. The vulnerability ( CVE-2021-1675 / CVE-2021-34527 ) has now been patched multiple times but is believed to still be exploitable .
The vulnerability itself is a privilege escalation bug found in the print spooler service on Windows platforms. It was believed to allow authenticated users to achieve escalated privileges, including admin rights. The vulnerability's severity was complicated by the fact that, if triggered, the vulnerability could affect domain controllers in enterprise networks. To make matters worse, this privilege escalation vulner
Tenable
CVE-2021-34527: Microsoft Releases Out-of-Band Patch for PrintNightmare Vulnerability in Windows Print Spooler
blogs_tenable·2021-07-07·CVSS 8.8
[HIGH] CVE-2021-34527: Microsoft Releases Out-of-Band Patch for PrintNightmare Vulnerability in Windows Print Spooler
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Fortinet
Fortinet Releases IPS Signature for Microsoft PrintNightmare Vulnerability | FortiGuard Labs
blogs_fortinet·2021-07-01·CVSS 7.8
[HIGH] Fortinet Releases IPS Signature for Microsoft PrintNightmare Vulnerability | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Fortinet Releases IPS Signature for Microsoft PrintNightmare Vulnerability
By FortiGuard Labs | July 01, 2021
FortiGuard Labs Breaking Update
A potentially new zero-day Microsoft vulnerability, dubbed "PrintNightmare," makes it possible for any authenticated attacker to remotely execute code with SYSTEM privileges on any machine that has the Windows Print Spooler service enabled (which is the default setting). Security researchers initially believed this vulnerability to be tied to CVE-2021-1675 (Windows Print Spooler Remote Code Execution Vulnerability), which was first disclosed in the June 8, 2021, Microsoft Patch Tuesday release. But there is now some question about whether this is the same issue or a new zero-day vulnerability.
Last week, researcher
Huntress
Critical Vuln.: PrintNightmare Exposes Windows Servers to RCE | Huntress
blogs_huntress·2021-06-30·CVSS 7.8
CVE-2021-1675 [HIGH] Critical Vuln.: PrintNightmare Exposes Windows Servers to RCE | Huntress
On June 29, Huntress was made aware of CVE-2021-1675 (now termed CVE-2021-34527) , a critical remote code execution and local privilege escalation vulnerability dubbed “PrintNightmare.”
Microsoft released a patch on June 8 considering this vulnerability low in severity. On June 21, PrintNightmare was updated to critical severity as the potential for remote code execution was uncovered. The June 8 Microsoft patch did not successfully resolve the issue for CVE-2021-32547 PrintNightmare, but it did resolve CVE-2021-1675.
UPDATE July 07 @ 12pm ET: On July 6, Microsoft updated their advisory on CVE-2021-34527 and released emergency patches, but the effectiveness of this security update is still under scrutiny.
Members of our Huntress team have validated the new patch on Windows 21H1 Enterpri
Tenable
CVE-2021-1675: Proof-of-Concept Leaked for Critical Windows Print Spooler Vulnerability
blogs_tenable·2021-06-29·CVSS 7.8
[HIGH] CVE-2021-1675: Proof-of-Concept Leaked for Critical Windows Print Spooler Vulnerability
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
Microsoft & Adobe Patch Tuesday (June 2021) – Microsoft 50 Vulnerabilities with 5 Critical, Adobe 21 Critical Vulnerabilities
blogs_qualys·2021-06-08·CVSS 5.2
CVE-2021-31985 [MEDIUM] Microsoft & Adobe Patch Tuesday (June 2021) – Microsoft 50 Vulnerabilities with 5 Critical, Adobe 21 Critical Vulnerabilities
## Microsoft Patch Tuesday – June 2021
Microsoft patched 50 CVEs in their June 2021 Patch Tuesday release, and five of them are rated as critical severity. Six have applicable exploits.
## Critical Microsoft Vulnerabilities Patched
CVE-2021-31985 – Microsoft Defender Remote Code Execution Vulnerability
Microsoft released patches addressing a critical RCE vulnerability in its Defender product (CVE-2021-31985). This CVE has a high likelihood of exploitability and is assigned a CVSSv3 base score of 7.8 by the vendor.
CVE-2021-31959 – Scripting Engine Memory Corruption Vulnerability
Microsoft released patches addressing a critical memory corruption vulnerability in the Chakra JScript scripting engine. This vulnerability impacts Windows RT, Windows 7, Windows 8, Windows 10, Windows Server
Securelist
Ransomware by the numbers: Reassessing the threat’s global impact
blogs_securelist·2021-04-23
Ransomware by the numbers: Reassessing the threat’s global impact
Table of Contents
- Key findings
- Methodology
- Ransomware across all platforms
- Mobile ransomware
- The rise of targeted ransomware
- Conclusion
Authors
- Kaspersky
Kaspersky has been following the ransomware landscape for years. In the past, we’ve published yearly reports on the subject: PC ransomware in 2014-2016, Ransomware in 2016-2017, and Ransomware and malicious crypto miners in 2016-2018. In fact, in 2019, we chose ransomware as the story of the year, upon noticing the well-known threat was shifting its attention to municipalities. In the 2010s, with campaigns like WannaCry and NotPetya, ransomware became mainstream news. However, starting in 2018, we began noticing something else: the statistics for the overall number of ransomware detections were on a steep decline. What
Securelist
How we protect our users against the Sunburst backdoor
blogs_securelist·2020-12-23
How we protect our users against the Sunburst backdoor
Authors
- Kaspersky
## What happened
SolarWinds, a well-known IT managed services provider, has recently become a victim of a cyberattack. Their product Orion Platform, a solution for monitoring and managing their customers’ IT infrastructure, was compromised by threat actors. This resulted in the deployment of a custom Sunburst backdoor on the networks of more than 18,000 SolarWinds customers, with many large corporations and government entities among the victims.
According to our Threat Intelligence data, the victims of this sophisticated supply-chain attack were located all around the globe: the Americas, Europe, Middle East, Africa and Asia.
After the initial compromise, the attackers appear to have chosen the most valuable targets among their victims. The companies that appeared
Crowdstrike
How CrowdStrike Protects Against PrintNightmare Vulnerability
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] How CrowdStrike Protects Against PrintNightmare Vulnerability
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
Crowdstrike
Patch Tuesday 2021: A Vulnerability Deep Dive
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] Patch Tuesday 2021: A Vulnerability Deep Dive
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
Crowdstrike
Magniber Ransomware Caught Using PrintNightmare Vulnerability
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] Magniber Ransomware Caught Using PrintNightmare Vulnerability
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
Sentinelone
Vice Society
blogs_sentinelone·CVSS 7.8
[HIGH] Vice Society
# Vice Society Ransomware: In-Depth Analysis, Detection, and Mitigation
## What is Vice Society Ransomware?
Vice Society is a multi-pronged extortion and ransomware group which emerged in early to mid 2021. The group also leverages both Windows and Linux variations of ransomware. The latter of which is frequently observed in campaigns targeting ESXi or heavily virtualized environments. Vice Society is known to ‘outsource’ the development of their ransomware payloads.
## What Does Vice Society Ransomware Target?
Vice Society ransomware is known to target large enterprises and high-value targets as well as medium-sized businesses. They have also been known to focus on organizations in the government, healthcare, and educational sectors. Vice Society is observed to heavily target virtuali
Huntress
Critical Vuln.: PrintNightmare Exposes Windows Servers to RCE | Huntress
blogs_huntress·CVSS 7.8
CVE-2021-1675 [HIGH] Critical Vuln.: PrintNightmare Exposes Windows Servers to RCE | Huntress
On June 29, Huntress was made aware of CVE-2021-1675 (now termed CVE-2021-34527), a critical remote code execution and local privilege escalation vulnerability dubbed “PrintNightmare.”
Microsoft released a patch on June 8 considering this vulnerability low in severity. On June 21, PrintNightmare was updated to critical severity as the potential for remote code execution was uncovered. The June 8 Microsoft patch did not successfully resolve the issue for CVE-2021-32547 PrintNightmare, but it did resolve CVE-2021-1675.
UPDATE July 07 @ 12pm ET: On July 6, Microsoft updated their advisory on CVE-2021-34527 and released emergency patches, but the effectiveness of this security update is still under scrutiny.
Members of our Huntress team have validated the new patch on Windows 21H1 Enterpris
Crowdstrike
Patch Tuesday 2021: A Vulnerability Deep Dive
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] Patch Tuesday 2021: A Vulnerability Deep Dive
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
Crowdstrike
Magniber Ransomware Caught Using PrintNightmare Vulnerability
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] Magniber Ransomware Caught Using PrintNightmare Vulnerability
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
arXiv
POLAR: Automating Cyber Threat Prioritization through LLM-Powered Assessment
arxiv_fulltext·2025-10-02
POLAR: Automating Cyber Threat Prioritization through LLM-Powered Assessment
## Abstract
The rapid expansion of the cyber threat landscape, with over 11,000 new vulnerabilities reported in 2024 alone, has intensified the need for effective threat prioritization. Existing approaches, from rule-based systems to machine learning models, struggle with scalability, distribution shift, and context-independent scoring, often mis-ranking threats in dynamic exploitation environments. In this work, we present , an LLM-based framework that automates cyber threat prioritization across four sequential stages: Triage, Static Analysis, Exploitation Analysis, and Mitigation Recommendation. leverages LLM reasoning to transform unstructured threat intelligence into structured severity metrics, forecast exploitation likelihood using temporal narratives, and generate prioritized miti
CTF
Driver / README
ctf_writeups
Driver / README
# Driver Writeup
## Enumeration
### Nmap
First, let's scan for open ports using `nmap`. We can quickly scan for open ports and store them in a variable: `ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.106 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)`. Then, we can scan those specific ports in depth by running `nmap`'s built-in scripts: `nmap -p$ports -sC -sV 10.10.11.106`.
```
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
| http-auth:
| HTTP/1.1 401 Unauthorized\x0D
|_ Basic realm=MFP Firmware Update Center. Please enter password for admin
|_http-server-header: Microsoft-IIS/10.0
135/tcp open msrpc Microsoft Windows RPC
445/tcp ope
CTF
tryhackme-rooms / hololive
ctf_writeups
tryhackme-rooms / hololive
# Hololive
This isn't so much a walkthrough as a sort of cheat sheet to plow through the machines. Instead of covenant, sshuttle or chisel I did all pivoting/forwarding using https://github.com/NHAS/reverse_ssh, which allowed me to treat each compromised machine as sort of a ssh server for which I had the private key using my attack box, which ran the server, as a jump host.
I also ran a webserver on port 1234 from the reverse ssh bin directory, to allow client binaries to be pulled.
## First machine
You need to log in over web first with the creds you can gain from file inclusion on dev.holo.live to admin.holo.live. Then the below will download the client and run it.
```
curl -H "Host: admin.holo.live" -H "Cookie: PHPSESSID=r77viip9g6kk79uharpdu94suq" "http://10.200.107.33/dashboard.
CTF
tryhackme-rooms / vulnnetactive
ctf_writeups
tryhackme-rooms / vulnnetactive
# Vulnnet: Active
https://tryhackme.com/room/vulnnetactive
I found this room very hard, with a bunch of new techniques I haven't seen before. So worth writing up.
1. Enumeration reveals a bunch of ports, though notably no web port, ssh or rdp. Even though its a windows machine, the only interaction seems to be via SMB and an exposed Redis instance on 6379.
2. The Redis instance was running version 2.8, and did not require authentication. It contained no keys of note. However, this version of Redis contains a 'vulnerability' where you can use 'dofile' in the LUA sandbox, allowing you to access files or network shares. E.g. `EVAL "dofile('/etc/passwd')" 0` would work on a linux machine.
3. For a windows machine, notably, this can be used to access network shares. Which means, if I set up
CTF
Driver / README
ctf_writeups·CVSS 7.8
[HIGH] Driver / README
# Driver - HackTheBox - Writeup
Windows, 20 Base Points, Easy
## Machine
## TL;DR
To solve this machine, we begin by enumerating open services using ```namp``` – finding ports ```21```, ```135```,```445``` and ```5985```.
***User***: Found ```admin:admin``` credentials for port ```80```, Using [smb-share-scf-file-attack](https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/), Getting the user NTLM hash using ```responder``` and we get the credentials of ```tony``` user.
***Root***: By running ```Get-Service -Name "spooler"``` we can see that print spooler service is running - Using [PrintNightmare](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675) to get privilege escalation by creating a new user on administrator group.
## Driver Solution
### Us
CTF
easy / README
ctf_writeups·CVSS 6.0
[MEDIUM] easy / README
---
layout: default
title: Easy Machines
parent: Machines
nav_order: 1
description: "120+ Easy HTB machine writeups with walkthroughs"
permalink: /machines/easy/
---
# HackTheBox Easy Machines - Comprehensive Reference
> Complete catalog of retired HTB Easy machines with OS, key vulnerability, attack path summary, and quality writeup links.
**Total: 100+ Easy Machines** | Updated: April 2026
---
## Quick Navigation
- [Classic / Legacy Machines (2017-2019)](#classic--legacy-machines-2017-2019)
- [2019-2020 Machines](#2019-2020-machines)
- [2021 Machines](#2021-machines)
- [2022 Machines](#2022-machines)
- [2023 Machines](#2023-machines)
- [2024 Machines (Season 4 & 5)](#2024-machines-season-4--5)
- [2025-2026 Machines (Season 6+)](#2025-2026-machines-season-6)
---
## Classic / Legac
CTF
README
ctf_writeups·CVSS 9.8
[CRITICAL] README
# Boot to root CTFs
Walkthroughs and notes of 'boot to root' CTFs mostly from VulnHub that I did for fun. I like to use vulnerable VMs from VulnHub (in addition to the ones I create) to organize hands-on penetration testing training sessions for junior security auditors/consultants :-)
### >> Classic pentest methodology to do a Boot2root CTF upload a Webshell)
➤ Clear-text passwords stored in 'public' website pages, configuration files, log files
➤ ...
2. Exploiting unpatched known vulnerabilities
➤ Web server (e.g. Apache Struts RCE: CVE-2017-12611/CVE-2017-9805/CVE-2017-9791, JBoss Java Deserialization RCE)
➤ Bash & web server CGI (e.g. Shellshock RCE CVE-2014-6271/CVE-2014-7169)
➤ Web CMS (e.g. Drupalgeddon2 RCE CVE-2018-7600)
➤ Web framework (e.g. PHP CGI RCE CVE-2012-1823)
➤ FTP s
http://packetstormsecurity.com/files/163349/Microsoft-PrintNightmare-Proof-Of-Concept.htmlhttp://packetstormsecurity.com/files/163351/PrintNightmare-Windows-Spooler-Service-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/167261/Print-Spooler-Remote-DLL-Injection.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1675https://www.kb.cert.org/vuls/id/383432http://packetstormsecurity.com/files/163349/Microsoft-PrintNightmare-Proof-Of-Concept.htmlhttp://packetstormsecurity.com/files/163351/PrintNightmare-Windows-Spooler-Service-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/167261/Print-Spooler-Remote-DLL-Injection.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1675https://www.kb.cert.org/vuls/id/383432https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1675
2021-06-08
Published
2021-11-03
Added to CISA KEV
Exploited in the wild