In June, researchers inadvertently published a proof of concept (PoC) exploit for a critical Windows Print Spooler vulnerability, dubbed PrintNightmare that enables users to gain access to corporate networks.
Although a patch for the vulnerability has been released, the vast majority of users have not downloaded or installed it yet, and while the exploit was quickly taken off GitHub, some managed to download and republish it.
Evgeny Lopatin, security expert at Kaspersky, says the vulnerability is serious because it enables bad actors to gain access to other computers within an organisation’s network. “Since the exploit is publicly available, a lot of fraudsters will take advantage of it. Therefore, we urge all users to apply the latest security updates for Windows,” he adds.
Also Read: Is Security Key To Your Cloud-Native Strategy?
He says PrintNightmare can be used by attackers with a regular user account, to take control of vulnerable servers or client machines that run the Windows Print Spooler service.
It gives the attacker an opportunity to distribute and install malicious programs on a victim’s computer (including vulnerable domain controllers), as well as steal stored data and create new accounts with full user rights, he adds.
Once the first version of the PoC exploit became publicly available, researchers began to publish additional versions of this exploit.
The PrintNightmare vulnerability is also subject to exploitation in new modules of frameworks, such as Mimikatz and Metasploit.
As a result, Kaspersky experts predict a growing number of attempts to gain access to corporate resources using the PrintNightmare exploit, accompanied by the high risk of ransomware infection and data theft
