Threat Source newsletter (Aug. 19, 2021)

Summary: Cisco Talos reported that the Vice Society group is exploiting the PrintNightmare vulnerability (CVE-2021-1675 / CVE-2021-34527) in Windows' print spooler service to move laterally across victim networks as part of a recent ransomware attack. Talos also detected increased ServHelper RAT activity in mid-June, installed via GoLang droppers, .NET droppers or PowerShell scripts and generally linked to Group TA505, which has been active for at least seven years.
Why it matters: Talos says multiple distinct threat actors now view PrintNightmare as attractive to use, which may indicate the vulnerability will see more widespread adoption by adversaries - and the fix is a Microsoft patch that many organizations may still not have applied.

Read the original at Cisco Talos ↗

Topics: Detection & Response
Mentions: CVE-2021-1675 CVE-2021-34527
Related: Print Nightmare: Here’s what you need to know and Talos’ coverage Cyber Risks ·
Vice Society leverages Print Nightmare in ransomware attacks Cyber Risks ·
Threat Brief: Windows Print Spooler RCE Vulnerability (CVE-2021-34527 AKA Print Nightmare) Cyber Risks ·