Russian state actors exploit PrintNightmare and MFA misconfigurations
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Russian APT actors bypassed MFA by exploiting default Duo settings and PrintNightmare to access NGO networks.
Between May 2021 and the advisory's publication in March 2022, Russian state-sponsored cyber actors gained access to an NGO by exploiting a combination of weak security controls and a known critical vulnerability. Initial access came through brute-force password guessing against a dormant account that had been unenrolled from Duo MFA but left active in Active Directory. Exploiting Duo's default "fail open" configuration, the actors enrolled a new MFA device for the compromised account, completing authentication and gaining network access.
Once inside, the actors escalated privileges using CVE-2021-34527 (PrintNightmare), a critical Windows Print Spooler remote code execution flaw, to obtain administrator-level access. They then modified the hosts file on a domain controller to redirect Duo MFA API calls to localhost, effectively disabling MFA enforcement across the network due to its default fail-open behavior. With MFA bypassed, the actors authenticated to the VPN and RDP as standard users, enumerated additional domain accounts using Windows utilities, and moved laterally to cloud storage and email systems for document exfiltration.
The attack demonstrates how default MFA configurations, inactive account management failures, and unpatched critical vulnerabilities create a cascade of exploitable weaknesses. The tactics involved only native Windows utilities (regedit, ntdsutil, rar, ping), making detection and forensics challenging.
Mentioned in this report
Detection guidance
Ntdsutil Used to Dump Active Directory Database (IFM/NTDS)
ntdsutil.exe activating the NTDS instance or creating an IFM full snapshot, used to extract ntds.dit for offline credential theft. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ntdsutil Used to Dump Active Directory Database (IFM/NTDS)
description: Detects ntdsutil.exe invoked with arguments that activate the NTDS instance
or create an install-from-media (IFM) snapshot, which copies ntds.dit and the SYSTEM
hive for offline credential extraction. Generalises on the ntdsutil sub-commands,
not on output paths.
tags:
- attack.credential-access
- attack.t1003.003
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \ntdsutil.exe
CommandLine|contains:
- ac i ntds
- activate instance ntds
- ifm
- create full
condition: selection
falsepositives:
- Domain administrators creating IFM media to stage new domain controllers
- Scheduled AD backup or maintenance scripts that use ntdsutil snapshots
level: high
id: be1fd724-63c3-5ace-82db-e25326c136c7
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-074a
Command-Line Modification of Hosts File
A shell or scripting command writing to the Windows hosts file, e.g. redirecting MFA or security API hostnames to localhost to defeat fail-open MFA. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Command-Line Modification of Hosts File
description: Detects command lines that write to the Windows hosts file via redirection
or PowerShell/cmd write cmdlets. Actors used this on a domain controller to redirect
Duo MFA API hostnames to localhost, causing a fail-open MFA bypass. Generalises
on the write-to-hosts behaviour, not a specific hostname.
tags:
- attack.defense-impairment
- attack.credential-access
- attack.t1556
- attack.t1112
logsource:
category: process_creation
product: windows
detection:
selection_target:
CommandLine|contains: \drivers\etc\hosts
selection_write:
CommandLine|contains:
- '>>'
- Add-Content
- Set-Content
- Out-File
- 'echo '
- 'copy '
condition: selection_target and selection_write
falsepositives:
- Administrators or provisioning scripts adding internal host entries
- Security or VPN software installers editing the hosts file via command line
level: medium
id: 0347cf9a-74dc-58fc-aed2-1f6aa71ea646
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-074a
Print Spooler Spawning Shell or Script Interpreter (PrintNightmare)
spoolsv.exe spawning a command shell or script/LOLBin child, consistent with PrintNightmare (CVE-2021-34527) exploitation yielding SYSTEM code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Print Spooler Spawning Shell or Script Interpreter (PrintNightmare)
description: Detects spoolsv.exe as parent of command interpreters or script/proxy-execution
binaries. Successful PrintNightmare exploitation loads an attacker DLL into the
spooler running as SYSTEM, which commonly spawns shells or tooling.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \spoolsv.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \net.exe
- \net1.exe
- \whoami.exe
condition: selection
falsepositives:
- Legacy printer drivers or print management software that launch helper scripts from
the spooler
level: high
id: a7cc6eec-80fa-50f0-9dd5-d8cdb69fbc8d
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-074a
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-074a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs