Vice Society leverages Print Nightmare in ransomware attacks

Summary: Cisco Talos Incident Response observed the Vice Society ransomware group exploiting the PrintNightmare vulnerability (CVE-2021-1675 / CVE-2021-34527) in the Windows print spooler service to move laterally across a victim's network. Vice Society emerged in mid-2021 and runs big-game hunting and double-extortion attacks, primarily against small or midsize victims, with notable targeting of public school districts and educational institutions.
Bottom line: The actor used the sudo command to obtain credentials for a commercial backup solution, likely to deny the victim recovery without paying, and exfiltrated data over SMB (TCP/445) directly from a compromised domain controller to bypass egress filtering.

Read the original at Cisco Talos ↗

Topics: Threat Actors & Nation-State
Mentions: CVE-2021-1675 CVE-2021-34527
Related: Print Nightmare: Here’s what you need to know and Talos’ coverage Cyber Risks ·
Threat Source newsletter (Aug. 19, 2021) Cyber Risks ·
Threat Brief: Windows Print Spooler RCE Vulnerability (CVE-2021-34527 AKA Print Nightmare) Cyber Risks ·