Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials


Microsoft Threat Intelligence is publishing results of our longstanding investigation into activity by the Russian-based threat actor Forest Blizzard (STRONTIUM) using a custom tool to elevate privileges and steal credentials in compromised networks.

Since at least June 2020 and possibly as early as April 2019, Forest Blizzard has used the tool, which we refer to as GooseEgg, to exploit the CVE-2022-38028 vulnerability in Windows Print Spooler service by modifying a JavaScript constraints file and executing it with SYSTEM-level permissions. Microsoft has observed Forest Blizzard using GooseEgg as part of post-compromise activities against targets including Ukrainian, Western European, and North American government, non-governmental, education, and transportation sector organizations.

Read more…
Source: Microsoft


Sign up for our Newsletter


Related:

  • SideWinder targets the maritime and nuclear sectors with an updated toolset

    March 10, 2025

    Last year, Kaspersky researchers published an article about SideWinder, a highly prolific APT group whose primary targets have been military and government entities in Pakistan, Sri Lanka, China, and Nepal. In the article, they described activities that had mostly happened in the first half of the year. The researchers tried to draw attention to the group, ...

  • Threat Actor Delivers Highly Targeted Multistage Polyglot Malware

    March 4, 2025

    In fall 2024, UNK_CraftyCamel leveraged a compromised Indian electronics company to target fewer than five organizations in the United Arab Emirates with a malicious ZIP file that leveraged multiple polyglot files to eventually install a custom Go backdoor dubbed Sosano. Proofpoint uses the UNK_ designator to define clusters of activity that are still developing and have ...

  • Operation sea elephant: The dying walrus wandering the Indian Ocean

    March 3, 2025

    Operation Sea Elephant aims to spy on Chinese scientific research achievements in the field of ocean to ensure the dominance of a certain country in South Asia in the Indian Ocean. In mid-2024 QiAnXin Threat Intelligence Center researchers discovered the South Asian direction attack collection numbered UTG-Q-011, which, despite the fact that the collection’s subsequent plug-ins differed ...

  • Angry Likho: Old beasts in a new forest

    February 21, 2025

    Angry Likho (referred to as Sticky Werewolf by some vendors) is an APT group we’ve been monitoring since 2023. It bears a strong resemblance to Awaken Likho, which we’ve analyzed before, so we classified it within the Likho malicious activity cluster. However, Angry Likho’s attacks tend to be targeted, with a more compact infrastructure, a limited ...

  • Philippines reports foreign cyber intrusions targeting intelligence data, but no breaches

    February 18, 2025

    The Philippines has detected foreign attempts to access intelligence data, but its cyber minister said on Tuesday no breaches have been recorded so far. Attempts to steal data are wide-ranging, said minister for information and communications Ivan Uy. Advanced Persistent Threats or APTs have repeatedly attempted but failed to infiltrate government systems, suggesting the country’s cyber-defences ...

  • China’s Salt Typhoon hackers continue to breach telecom firms despite US sanctions

    February 13, 2025

    Security researchers say the Chinese government-linked hacking group, Salt Typhoon, is continuing to compromise telecommunications providers, despite the recent sanctions imposed by the U.S. government on the group. In a report shared with TechCrunch, threat intelligence firm Recorded Future said it had observed Salt Typhoon — which the company tracks as “RedMike” — breaching five telecommunications ...