Ransomware Operators Leverage PrintNightmare in Attacks

Ransomware Operators Leverage PrintNightmare in Attacks

In August 2021, security researchers discovered that ransomware groups utilized PrintNightmare vulnerabilities in ransomware attacks. PrintNightmare is a colloquial name for security flaws within the Microsoft Print Spooler service that gained significant attention in June and July 2021 due to the critical nature of the vulnerabilities. Ransomware groups Vice Society and Magniber were associated with using multiple PrintNightmare vulnerabilities in targeted infections. By making use of newly disclosed vulnerabilities, like the PrintNightmare flaws, ransomware operators have a higher chance of landing a successful infection, as the patch to remediate the vulnerable software or system is likely unavailable, thus placing potential targets at a higher risk for a ransomware attack.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Log and monitor all administrative actions as much as possible. Alert on any suspicious activity.
• Consider disabling, or at least logging, all network activity outside of normal business hours for most users where possible.
• If a workstation is infected with malware, quarantine it on a private network segment with no external connections.
• If you are alerted or suspect a compromised account, change the password immediately.
• Disable unneeded protocols on your network (UDP, IPX, NetBIOS) and monitor for any use of them.
• Monitor usage of dual-purpose tools such as Powershell for abnormal behaviors.
• Apply security patches or recommended workarounds provided by the Microsoft Security Response Center
• Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information. Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Security researchers have publicly reported two ransomware groups leveraging PrintNightmare vulnerabilities in their attacks: Vice Society and Magniber. Although Magniber ransomware has been around since 2017, Vice Society is new to ransomware operations (with known infections starting as early as June 2021) and is likely a variation of the HelloKitty ransomware. PrintNightmare does not refer to a single vulnerability — it is the colloquial name for a variety of security flaws in the Microsoft Windows Print Spooler service used to manage access to printing processes, resulting in privilege escalation or remote code execution exploits. Windows enables the Print Spooler service by default, and the critical vulnerabilities associated with PrintNightmare allow attackers to run arbitrary code, modify data, or move laterally across networks.

Magniber and Vice Society ransomware leveraged more than one PrintNightmare vulnerability in their attacks. Both groups used CVE-2021-1675 and CVE-2021-34527, and Magniber also used CVE-2021-36958 when infecting Windows operating systems. Although security researchers worked quickly to push a fix for the flawed software, further investigation into the Print Spooler services revealed that some vulnerabilities allowed attackers to gain SYSTEM privileges in Windows. Additionally, some of the patches released by Microsoft to fix the vulnerabilities led researchers to discover ways in which attackers could exploit the "Point and Print" feature in Windows printing services.

When PrintNightmare was first disclosed in June 2021, security researchers attributed the vulnerability to CVE-2021-1675 until a deep-dive analysis revealed that the flaw was slightly different, in that CVE-2021-1675 was a privilege escalation vulnerability. The new flaw was a remote code execution, thus receiving the label CVE-2021-34527. Additional issues emerged following updates to the PrintNightmare vulnerabilities, including a patch that would affect organizations that use networked printers. Essentially, enabling the patch prevented elevated users from installing printer drivers from remote servers. Although Microsoft provided mitigations for the printer issues, they later recommended against the mitigations claiming it was a risk that would expose the affected environment to Print Spooler service vulnerabilities.

PrintNightmare References on Cybercrime Forums and Networks

Despite available proof-of-concept (PoC) code for researchers to analyze PrintNightmare vulnerabilities, ZeroFox Research observed actors advertising PrintNightmare on three different Russian-speaking underground forums and marketplaces in June, July, and August 2021. While two of the three postings specifically reference CVE-2021-1675, the remaining post simply references "PrintNightmare" in the advertisement.

The first instance of PrintNightmare discussion involved an actor using the alias "pixe1" on a Russian-speaking forum posting about CVE-2021-1675 in June 2021. The actor linked a GitHub file containing a write-up on the vulnerability, posted a screenshot running the CVE code, and commented that it was a serious vulnerability in the Windows Print Spooler service that needs attention. The post has a reply from another actor commenting that the CVE uses remote code execution specifically for domain networks. Figure 1 is a screenshot of the thread translated from Russian to English.

Figure 1. Actor "pixe1" opens a thread on a Russian-speaking forum on CVE-2021-1675

The second instance occurred in late July 2021 when the actor "LORD1" advertised the sale of a penetration testing tool, Core Impact 2.1, as well as a PrintNightmare exploit integrated into the tool for USD 5,000 (Figure 2). The seller also states that PrintNightmare PoCs are publicly available for actors interested in purchasing exploit code.

Figure 2. Actor "LORD1" advertises the sale of Core Impact 2.1 containing PrintNightmare exploit code

The third instance of a PrintNightmare advertisement was when the actor "wav" advertised the sale of CVE-2021-1675 in August 2021. The actor claimed that the exploit was in PowerShell format (ps1) included an applied DLL file, and is supposedly encrypted from the Windows Antimalware Scan Interface (AMSI) and antivirus detection software. Figure 3 is a screenshot of the posting.

Figure 3. Actor "wav" advertises the sale of CVE-2021-1675 in PowerShell format with an applied DLL file

Conclusion

The number of vulnerabilities discovered in the Print Spooler service and the attempts at providing patches and recommendations to mitigate the issues highlight the severity of PrintNightmare and the need to remediate the vulnerabilities. Vice Society and Magniber demonstrated that using one more PrintNightmare flaw led to successful infections on their targets to encrypt and extort the target's sensitive data. Mitigating some of the PrintNightmare flaws introduced new obstacles to address security concerns and additional risks if specific patches were applied to vulnerable systems. The PrintNightmare exploits also demonstrated how ransomware operators could quickly leverage newly disclosed vulnerabilities in their attacks, as it can be advantageous and lead to a successful infection. Furthermore, more threat actors can continue using the PrintNightmare flaws against their targets if vulnerable systems remain unprotected.