# Russian state actors exploit PrintNightmare and MFA misconfigurations

Published: 2025-06-20 · Severity: elevated · Sectors: non-profit, government-national
Canonical: https://vorant.io/reports/7092cbd9-5588-50b9-b025-84d94ca80bdd/russian-state-actors-exploit-printnightmare-and-mfa-misconfigurations

> Russian APT actors bypassed MFA by exploiting default Duo settings and PrintNightmare to access NGO networks.

Between May 2021 and the advisory's publication in March 2022, Russian state-sponsored cyber actors gained access to an NGO by exploiting a combination of weak security controls and a known critical vulnerability. Initial access came through brute-force password guessing against a dormant account that had been unenrolled from Duo MFA but left active in Active Directory. Exploiting Duo's default "fail open" configuration, the actors enrolled a new MFA device for the compromised account, completing authentication and gaining network access.

Once inside, the actors escalated privileges using CVE-2021-34527 (PrintNightmare), a critical Windows Print Spooler remote code execution flaw, to obtain administrator-level access. They then modified the hosts file on a domain controller to redirect Duo MFA API calls to localhost, effectively disabling MFA enforcement across the network due to its default fail-open behavior. With MFA bypassed, the actors authenticated to the VPN and RDP as standard users, enumerated additional domain accounts using Windows utilities, and moved laterally to cloud storage and email systems for document exfiltration.

The attack demonstrates how default MFA configurations, inactive account management failures, and unpatched critical vulnerabilities create a cascade of exploitable weaknesses. The tactics involved only native Windows utilities (regedit, ntdsutil, rar, ping), making detection and forensics challenging.

## Mentioned in this report

- Vulnerabilities: CVE-2021-34527 (KEV)
- Threat actors: Russia-nexus activity (unattributed)

## Detection guidance (public sample)

### Ntdsutil Used to Dump Active Directory Database (IFM/NTDS)

ATT&CK: T1003.003

ntdsutil.exe activating the NTDS instance or creating an IFM full snapshot, used to extract ntds.dit for offline credential theft. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Ntdsutil Used to Dump Active Directory Database (IFM/NTDS)
description: Detects ntdsutil.exe invoked with arguments that activate the NTDS instance
  or create an install-from-media (IFM) snapshot, which copies ntds.dit and the SYSTEM
  hive for offline credential extraction. Generalises on the ntdsutil sub-commands,
  not on output paths.
tags:
- attack.credential-access
- attack.t1003.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \ntdsutil.exe
    CommandLine|contains:
    - ac i ntds
    - activate instance ntds
    - ifm
    - create full
  condition: selection
falsepositives:
- Domain administrators creating IFM media to stage new domain controllers
- Scheduled AD backup or maintenance scripts that use ntdsutil snapshots
level: high
id: be1fd724-63c3-5ace-82db-e25326c136c7
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-074a
```

### Command-Line Modification of Hosts File

ATT&CK: T1112

A shell or scripting command writing to the Windows hosts file, e.g. redirecting MFA or security API hostnames to localhost to defeat fail-open MFA. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Command-Line Modification of Hosts File
description: Detects command lines that write to the Windows hosts file via redirection
  or PowerShell/cmd write cmdlets. Actors used this on a domain controller to redirect
  Duo MFA API hostnames to localhost, causing a fail-open MFA bypass. Generalises
  on the write-to-hosts behaviour, not a specific hostname.
tags:
- attack.defense-impairment
- attack.credential-access
- attack.t1556
- attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection_target:
    CommandLine|contains: \drivers\etc\hosts
  selection_write:
    CommandLine|contains:
    - '>>'
    - Add-Content
    - Set-Content
    - Out-File
    - 'echo '
    - 'copy '
  condition: selection_target and selection_write
falsepositives:
- Administrators or provisioning scripts adding internal host entries
- Security or VPN software installers editing the hosts file via command line
level: medium
id: 0347cf9a-74dc-58fc-aed2-1f6aa71ea646
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-074a
```

### Print Spooler Spawning Shell or Script Interpreter (PrintNightmare)

ATT&CK: T1068

spoolsv.exe spawning a command shell or script/LOLBin child, consistent with PrintNightmare (CVE-2021-34527) exploitation yielding SYSTEM code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Print Spooler Spawning Shell or Script Interpreter (PrintNightmare)
description: Detects spoolsv.exe as parent of command interpreters or script/proxy-execution
  binaries. Successful PrintNightmare exploitation loads an attacker DLL into the
  spooler running as SYSTEM, which commonly spawns shells or tooling.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \spoolsv.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \net.exe
    - \net1.exe
    - \whoami.exe
  condition: selection
falsepositives:
- Legacy printer drivers or print management software that launch helper scripts from
  the spooler
level: high
id: a7cc6eec-80fa-50f0-9dd5-d8cdb69fbc8d
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-074a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-074a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/7092cbd9-5588-50b9-b025-84d94ca80bdd/russian-state-actors-exploit-printnightmare-and-mfa-misconfigurations.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup