Vice Society Used PrintNightmare for Lateral Movement in Ransomware Attack
Summary
Talos analyzed a Vice Society ransomware attack that used PrintNightmare for lateral movement and detailed the group’s tactics, including credential theft, defense evasion, backup targeting, and data exfiltration.
Key points
- Talos observed a PrintNightmare-associated DLL on victim systems, indicating the vulnerability was used to move laterally; Microsoft had released a security patch.
- The attackers used Impacket, WMI, PsExec, and proxychains for reconnaissance and remote execution.
- They sought access to backups, extracted credentials from LSASS and Active Directory, and tried to disable Windows protections and clear event logs.
- The attackers established persistence with a Windows service that ran PowerShell and downloaded a backdoor payload.
- They attempted to exfiltrate sensitive data over SMB and targeted backups and ESXi servers, complicating recovery.
- Talos recommended patching PrintNightmare, maintaining secure logging and offline backups, using MFA and egress filtering, and detecting abuse of legitimate system tools.
Article Details
- Attack Vectors
- Vice Society exploited PrintNightmare (CVE-2021-1675 / CVE-2021-34527) in the Windows print spooler for remote code execution and lateral movement.
- The attackers used Impacket and WMI for command execution and environment enumeration, and PsExec and PowerShell to execute commands or scripts on remote systems.
- The attackers used Windows Remote Desktop Connections and copied PowerShell scripts across systems for lateral movement.
- The attackers attempted to obtain credentials by dumping NTDS.dit and LSASS data using comsvcs.dll invoked through rundll32.exe.
- The attackers used a Windows service to launch encoded PowerShell for persistence, including downloading and executing a backdoor payload from an attacker-controlled server.
- The attackers attempted to evade detection by clearing Windows event logs, modifying registry settings, disabling Windows Defender, and bypassing AMSI and PowerShell logging.
- The attackers attempted to exfiltrate sensitive data over SMB (TCP/445) from a compromised domain controller.
- Defensive Notes
- Install the latest Microsoft PrintNightmare security patch.
- Maintain reliable, secure logging infrastructure.
- Use multi-factor authentication to make credential theft more difficult to exploit.
- Use egress filtering to prevent malicious traffic from reaching adversary infrastructure.
- Use endpoint detection and response that detects LOLBin abuse and malware implants.
- Maintain up-to-date offline backups that adversaries cannot target.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 6f191f598589b7708b1890d56b374b45c6eb41610d34f976f0b4cfde8d5731af | Hash of the PrintNightmare-associated DLL observed in the attack. |
MITRE ATT&CK
T1003 · OS Credential DumpingThe attackers attempted to obtain credentials by dumping NTDS.dit and LSASS data.T1003.001 · LSASS MemoryThe attackers invoked comsvcs.dll through rundll32.exe to dump LSASS data.T1021 · Remote ServicesThe attackers used Windows Remote Desktop Connections to pivot to other systems.T1033 · System Owner/User DiscoveryThe attackers conducted system owner/user discovery after initial access.T1047 · Windows Management InstrumentationImpacket was used to execute WMI commands on other systems.T1048 · Exfiltration Over Alternative ProtocolThe attackers attempted to exfiltrate sensitive information over SMB from a compromised domain controller.T1059.001 · PowerShellThe attackers used PowerShell for remote execution, persistence, and other post-compromise actions.T1059.003 · Windows Command ShellThe attackers used Windows Command Shell commands during post-compromise activity.T1070.001 · Clear Windows Event LogsThe attackers attempted to clear System, Security, and Application Windows Event Logs with wevtutil.T1087 · Account DiscoveryThe attackers performed account discovery.T1112 · Modify RegistryThe attackers modified registry settings to weaken remote administration restrictions and disable Windows Defender protections.T1482 · Domain Trust DiscoveryThe attackers used nltest to enumerate domain trust relationships.T1543 · Create or Modify System ProcessThe attackers created a Windows service named Updater to launch PowerShell for persistence.T1562.001 · Disable or Modify ToolsThe attackers disabled Windows Defender and used an AMSI bypass to impair defenses and evade detection.T1569.002 · Service ExecutionThe attackers used PsExec to execute commands remotely.T1570 · Lateral Tool TransferThe attackers copied PowerShell scripts to multiple systems in the environment.
CVE
CVE-2021-1675Another threat actor is actively exploiting the so-called PrintNightmarevulnerability (CVE-2021-1675 / CVE-2021-34527) in Windows' print spooler service to spread laterally across a victim's network as part of a recentCVE-2021-34527Another threat actor is actively exploiting the so-called PrintNightmarevulnerability (CVE-2021-1675 / CVE-2021-34527) in Windows' print spooler service to spread laterally across a victim's network as part of a recent
People
Threat Actors
Vendors
Ciscoservice to spread laterally across a victim's network as part of a recent ransomware attack, according to Cisco Talos Incident Response research. While previous research found that other threat actors had beenMicrosoftof ransomware. If users have not already, they should download the latest patch for PrintNightmare from Microsoft.
Products
Cisco Secure EndpointCisco Secure Endpoint is ideally suited to prevent the execution of the malware detailed in this post. New users can try Cisco Secure Endpoint for free here.Cisco Secure FirewallCisco Secure Firewall and Meraki MX can detect malicious activity associated with this threat.Cisco Secure Firewall Management CenterAdditional protections with context to your specific environment and threat data are available from the Cisco Secure Firewall Management Center.Cisco Secure Malware AnalyticsCisco Secure Malware Analytics helps identify malicious binaries and build protection into all Cisco Security products.Cisco Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.Cisco UmbrellaCisco Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network.ESXiThe degradation of ESXi servers used for virtualization in victim environments.Meraki MXCisco Secure Firewall and Meraki MX can detect malicious activity associated with this threat.Microsoft Windowsis actively exploiting the so-called PrintNightmarevulnerability (CVE-2021-1675 / CVE-2021-34527) in Windows' print spooler service to spread laterally across a victim's network as part of a recent ransomwareSnortOpen Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.The following SIDs have been released to detect this threat: 57876, 57877.
Tools
ImpacketThe use of utilities such as proxychains and impacket during the post-compromise phases of the attack lifecycle.Mimikatzclever living-off-the-land binary (LoLBin) tactic that avoids popular credential extraction tools like Mimikatz, which may alert defenders.proxychainsThe use of utilities such as proxychains and impacket during the post-compromise phases of the attack lifecycle.PsExec1> \\127.0.0.1\admin$\__[STRING] 2>&1We also observed the adversary using Windows Batch files to execute PSExec. In this case, PSExec remotely authenticated and executed PowerShell on remote systems within the