Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials

Since 2019, Forest Blizzard has used a custom post-compromise tool to exploit a vulnerability in the Windows Print Spooler service that allows elevated permissions. Microsoft has issued a security update addressing this vulnerability as CVE-2022-38028.

The post Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials appeared first on Microsoft Security Blog.

blizzard compromise credentials cve elevation of privilege exploit exploiting forest forest blizzard forest blizzard (strontium) government microsoft non-governmental organizations (ngos) permissions print print spooler security security update service tool update vulnerability windows windows print spooler