No ransomware groups have yet to claim responsibility for either attack, and both institutions have yet to reveal what may have been stolen.

Source: NicoElNino via Alamy Stock Photo

Two healthcare institutions, Frederick Health and New York Blood Center Enterprises (NYBCe), are grappling with disruptions from separate ransomware attacks they faced this past week.

Frederick Health posted an update to its website on Jan. 27 noting that it "recently identified a ransomware event" and is working to contain it with third-party cybersecurity experts to get its systems back online.

Though most of its facilities remain open and are still providing patient care, Frederick Health reported that its Village Laboratory is closed and that patients may experience some operational delays.

New York Blood Center Enterprises, a nonprofit made up of a collection of independent blood centers, first identified suspicious activity affecting its IT systems on Jan. 26. On Jan. 29, it alerted the public that it took its systems offline in an effort to contain the threat, which was attributed to a ransomware attack. NYBCe is working to restore its systems; however, it remains unclear when it will be fully operational again. The organization expects processing times for blood donations at its centers and offsite blood drives may take longer than usual.

Neither institutions has released any information regarding who breached them or if any information was stolen; no ransomware groups have yet to take responsibility for the attacks.

**A Never-Ending List**

Ransomware attacks have become a harsh reality in healthcare. Unlike other industrial sectors that face similar threats, it's not just reputational damage or financial strain — in the medical field it's patients' lives at stake.

According to a 2024 Microsoft study, nearly 400 US healthcare organizations were infected with ransomware, with the average reported payment as high as $4.4 million. The downtime these facilities experience while getting back on their feet can cost up to $900,000. 

Healthcare institutions offer a plethora of information and data types, ranging from medical records to financial details, and a variety of personally identifiable information.

"Many healthcare organizations operate with limited cybersecurity funding and staffing, prioritizing patient care over IT security investments," Heath Renfrow, co-founder of Fenix24, tells Dark Reading. "The vast number of endpoints, third-party vendors, and interconnected systems create a broad attack surface, while the inability to routinely take systems offline for maintenance exacerbates vulnerabilities."

And when threat actors do decide to breach these healthcare organizations' networks, they steal this information, holding it for ransom while knowing that their efforts will pay off because these healthcare systems have everything to lose. For them, these malicious events only add to the intensity of the life-and-death situations they experience every day.

Ultimately, this is why the reported ransom payments are often so high, since healthcare institutions have a known track record for their willingness to pay bad actors whatever's necessary in order to get their patients the care they need.

**Strategizing Against Wayward Morals**

Combating the ransomware scourge has tested lots of organizations and security professionals. The ransomware groups have shown themselves adept at evolving their use of technology to circumvent new fixes; their business models are constantly evolving with affiliates, commissions, and even referral programs.

"Some ransomware groups claim to have ethical boundaries, stating they won't target hospitals, but history has shown that these promises are often empty, with critical care facilities still falling victim," Renfrow says. "On the other side, healthcare organizations have an ethical duty to protect patient data and ensure operational resilience. However, constrained budgets and competing priorities often force tough decisions between investing in cybersecurity and funding direct patient care."

But changes must be made to cybersecurity practices in the healthcare industry if patient care is going to prevail in the long run.

In May 2024, the Advanced Research Projects Agency for Health (ARPA-H), a funding agency created by the Biden administration, committed $50 million to help create software for making hospitals more cyber resilient.

The program, called Universal Patching and Remediation for Autonomous Defense (Upgrade), is focused on areas such as vulnerability management, auto-detection, defense, and more, and seeks to bring together hospital IT staff, equipment managers, and cybersecurity experts to uncover cybersecurity vulnerabilities.

And even the Department of Health and Human Services (HHS) saw the importance of bolstering healthcare cybersecurity programs after a United Healthcare subsidiary was targeted by the BlackCat ransomware group early last year, leading to disarray and outages in what was one of the worst breaches the healthcare sector has ever seen.

As for what healthcare institutions themselves can do, Renfrow says that "immutable backups with guaranteed return-to-operations (RTO) must be their top priority — not just assumed, but tested and proven" as this "ensures that when — not if — an attack happens, healthcare organizations can restore operations immediately, without disruption, without ransom."

"In today's world," he says, "true resilience is the only security guarantee."

Healthcare Sector Charts 2 More Ransomware Attacks

Whether by intercepting its traffic or just giving it a little nudge, GitHub's AI assistant can be made to do malicious things it isn't supposed to.

Source: Mykhailo Polenok via Alamy Stock Photo

Researchers have discovered two new ways to manipulate GitHub's artificial intelligence (AI) coding assistant, Copilot, enabling the ability to bypass security restrictions and subscription fees, train malicious models, and more.

The first trick involves embedding chat interactions inside of Copilot code, taking advantage of the AI's instinct to be helpful in order to get it to produce malicious outputs. The second method focuses on rerouting Copilot through a proxy server in order to communicate directly with the OpenAI models it integrates with.

Researchers from Apex deem these issues vulnerabilities. GitHub disagrees, characterizing them as "off-topic chat responses," and an "abuse issue," respectively. In response to an inquiry from Dark Reading, GitHub wrote, "We continue to improve on safety measures in place to prevent harmful and offensive outputs as part of our responsible AI development. Furthermore, we continue to invest in opportunities to prevent abuse, such as the one described in Issue 2, to ensure the intended use of our products."

**Jailbreaking GitHub Copilot**

"Copilot tries as best as it can to help you write code, \[including\] everything you write inside a code file," Fufu Shpigelman, vulnerability researcher at Apex explains. "But in a code file, you can also write a conversation between a user and an assistant."

In the screenshot below, for example, a developer embeds within their code a chatbot prompt, from the perspective of an end user. The prompt carries ill intent, asking Copilot to write a keylogger. In response, Copilot suggests a safe output denying the request:

Source: Apex

The developer, however, is in full control over this environment. They can simply delete Copilot's autocomplete response, and replace it with a malicious one.

Or, better yet, they can influence Copilot with a simple nudge. As Shpigelman notes, "It's designed to complete meaningful sentences. So if I delete the sentence 'Sorry, I can't assist with that,' and replace it with the word 'Sure,' it tries to think of how to complete a sentence that starts with the word 'Sure.' And then it helps you with your malicious activity as much as you want." In other words, getting Copilot to write a keylogger in this context is as simple as gaslighting it into thinking it wants to.

Source: Apex

A developer could use this trick to generate malware, or malicious outputs of other kinds, like instructions on how to engineer a bioweapon. Or, perhaps, they could use Copilot to embed these sorts of malicious behaviors into their own chatbot, then distribute it to the public.

**Breaking Out of Copilot Using a Proxy**

To generate novel coding suggestions, or process a response to a prompt — for example, a request to write a keylogger — Copilot engages help from cloud-based large language models (LLM) like Claude, Google Gemini, or OpenAI models, via those models' application programming interfaces (APIs).

The second scheme Apex researchers came up with allowed them to plant themselves in the middle of this engagement. First they modified Copilot's configuration, adjusting its "github.copilot.advanced.debug.overrideProxyUrl" setting to redirect traffic through their own proxy server. Then, when they asked Copilot to generate code suggestions, their server intercepted the requests it generated, capturing the token Copilot uses to authenticate with OpenAI. With the necessary credential in hand, they were able to access OpenAI's models without any limits or restrictions, and without having to pay for the privilege.

And this token isn't the only juicy item they found in transit. "When Copilot \[engages with\] the server, it sends its system prompt, along with your prompt, and also the history of prompts and responses it sent before," Shpigelman explains. Putting aside the privacy risk that comes with exposing a long history of prompts, this data contains ample opportunity to abuse how Copilot was designed to work.

A "system prompt" is a set of instructions that defines the character of an AI — its constraints, what kinds of responses it should generate, etc. Copilot's system prompt, for example, is designed to block various ways it might otherwise be used maliciously. But by intercepting it en route to an LLM API, Shpigelman claims, "I can change the system prompt, so I won't have to try so hard later to manipulate it. I can just \[modify\] the system prompt to give me harmful content, or even talk about something that is not related to code."

For Tomer Avni, co-founder and CPO of Apex, the lesson in both of these Copilot weaknesses "is not that GitHub isn't trying to provide guardrails. But there is something about the nature of an LLM, that it can always be manipulated no matter how many guardrails you're implementing. And that's why we believe there needs to be an independent security layer on top of it that looks for these vulnerabilities."

**About the Author**

Nate Nelson is a writer based in New York City. He formerly worked as a reporter at Threatpost, and wrote "Malicious Life," an award-winning Top 20 tech podcast on Apple and Spotify. Outside of Dark Reading, he also co-hosts "The Industrial Security Podcast."

New Jailbreaks Allow Users to Manipulate GitHub Copilot

The rate of evolution has been glacial, but tools now understand cloud environments and can target Web applications.

Alex Haynes, Chief Information Security Officer, IBS Software

January 30, 2025

4 Min Read

Source: Rancz Andrei via Alamy Stock Photo

COMMENTARY

When automated pen-testing tools appeared a few years ago they prompted an interesting question: How close are they to replacing human pen testers? While the short answer was "not that close — yet," they definitely had potential and were worth keeping an eye on.

As I've just had the chance to review the latest iteration of these tools, it's interesting to see how they've evolved and how close are they now are to replacing the human pen tester for offensive security work.

When I test an automated pen tester, I compare it with a human one, in terms of speed, capability, and capacity, as well as output (i.e., the resulting report). The big problems earlier automated pen testers suffered from included:

*   Difficulty exploiting or seeing certain things that are obvious to human pen testers, including taking advantage of vulnerabilities that have publicly released exploits
    
*   Did not understand Web applications, at all 
    
*   Could only be used from "inside" the network; they couldn't pen test from the outside (mainly due to the aforementioned ignorance of Web applications)
    

**How Have Automated Pen Testers Changed Since Then?**

New pen testers finally understand Web applications — hooray! They can attack them both from inside and outside the perimeter. This is a welcome development, but they still have teething issues. Due to a very mature market in Web application scanners they would need to be able to both detect vulnerabilities with a low false positive ratio and be able to exploit them to pivot to other assets.

Unfortunately, they don't do this well enough to be distinctive in their own right — they'll find vulnerabilities that are obvious enough, but on a vulnerable box weren't able to detect even blatant SQLi or validate potential XSS vulnerabilities to weed out false positives. There are flashes of brilliance, however. An internal Web endpoint had a file upload vulnerability that was previously undetected by any other tool (this wasn't even found by human pen testers), but overall, it's underwhelming. Today's offerings in Web application scanners will do much better than this.

The second big improvement is cloud environments. As most pen testers will tell you, navigating an on-premises Active Directory-based environment is markedly different from pivoting in a native Amazon Web Services (AWS) environment, as the assets and the exploits you will use are completely different. Privilege escalation now relies on leveraging poorly configured cloud assets to abuse an identity and access management (IAM) role or grab some AWS keys to go further. Naturally, you'll also find the traditional vulnerabilities that include unpatched machines and misconfigured ports and services. Here, again, automated pen-testing tools have evolved, and can navigate and understand these environments. This puts them on par with CNAPP-type offerings, since they aren't bound by the traditional VM- or IP-bound asset.

As the cloud is a relatively new sphere for these tools, they can struggle. Unless they are given an assumed role, they won't find much at all. What's worse, they will flag the fact that they've assumed an IAM role a vulnerability itself — this would be like giving pen testers local admin abilities so they can begin a pen test and them pointing out your security is bad because you've just given them local admin.

Automated pen testers also struggle to enumerate their own network when they are given access — machines that are obviously on the same virtual private cloud (VPC) or virtual LAN (VLAN) will be ignored or scanned haphazardly. This is better than some automated pen testing tools that still don't even work in cloud environments unless they can reach an Active Directory machine. 

**Automated Pen Testers' Advantages**

All of the other advantages you'd expect from these tools remain, however. They can run through an iteration of a pen test quickly — in a matter of hours if you wish (this is configurable). The reports they produce are top-notch and comparable to any report a human pen tester would produce. If you were to hand this to a qualified security assessor (QSA), they would have a hard time distinguishing the difference.

Naturally, due to their automated nature, you can propagate these on huge environments and repeat them on a daily basis if you wish. This is where automated pen testers leave humans in the dust — no company can repeat daily pen tests on large environments, even with significant budgets, nor would the human team be able to complete it in this time and write up a report with verifiable actions to make it meaningful enough. (Keep one thing in mind: These tools aren't cheap.)

Overall, it's good to see these tools evolve. The rate of change is glacial, but they now understand cloud environments and can target Web applications, though they are still temperamental, costly, and miss a few things. One could argue humans are the same. For now, however, humans maintain the advantage — but they aren't mutually exclusive. Just like crowdsourced security and traditional pen testing, automated pen testing is now another tool that can be layered onto your offensive security testing, where it can help you find the exploits that matter to your organization.

**About the Author**

Chief Information Security Officer, IBS Software

Alex Haynes is a former pen tester with a background in offensive security and is credited for discovering vulnerabilities in products by Microsoft, Adobe, Pinterest, Amazon Web Services and IBM. He is a former top 10 ranked researcher on Bugcrowd and a member of the Synack Red Team. He is currently CISO at IBS Software. Alex has contributed to United States Cyber Security Magazine, Cyber Defense Magazine, Infosecurity Magazine, and IAPP tech blog. He also has spoken at security conferences including OWASP and ISC Security Summits.

Automated Pen Testing Is Improving — Slowly

The addition of Solvo CSPM to CYE Hyver aims to address the need for multicloud vulnerability monitoring and risk assessment.

Source: Nicolas Menijes Crego via Alamy Stock Photo

NEWS BRIEF

CYE has acquired Solvo as part of its goal to expand the capabilities of its continuous exposure management platform. Terms of the acquisition were not disclosed.

The deal, announced on Wednesday, brings together two Israeli-based cybersecurity companies. CYE will combine Solvo's Cloud Security Posture Management (CSPM) and Cloud Infrastructure Entitlement Management (CIEM) offerings with its own Hyver platform. According to CYE founder and CEO Reuven Aronashvili, CYE will integrate Solvo's CSPM capabilities next quarter to boost its customers' ability to continuously assess and mitigate cyber-risks in multicloud and hybrid infrastructure environments.

Hyver, which provides visual views of an organization's security posture, is designed to prioritize risks, compare the cost of a breach with the cost of remediation, provide risk mitigation planning, measure cybersecurity maturity, and create remediation plans. It also integrates with various security tools and platforms, enabling the sharing of threat detection telemetry. Solvo CSPM provides continuous monitoring of cloud environments while also prioritizing risks, discovering misconfigurations and compliance risks, and visualizing cloud assets and network and identity and access management (IAM) configurations to determine risks.

The need to bring Solvo's CSPM capability to Hyver became apparent as customers were accelerating the migration of their systems and applications to the cloud, Aronashvili says.

"We needed some kind of native access to the cloud environment in order to address access level, encryption level, MFA connectivity, and so on," Aronashvili says. "All those elements that are covered today with different cloud providers and platforms out there are missing in a lot of the coverage today."

Solvo offers native integration with Amazon Web Services, Microsoft Azure, and Google Cloud, which Aronashvili said has become a critical requirement for CYE's Hyber.

"The multicloud aspect was very important to us," he says. "Now we're able to provide an organization with a very comprehensive and complete risk evaluation process that considers all the different aspects of cybersecurity."

Aronashvili founded CYE in 2012 after working as a cybersecurity specialist while serving in the Israel Defense Forces. CYE started out as a professional services company, but in 2021 it rolled out Hyver after receiving $100 million in funding from EQT, with participation from its initial investor, 83 North. In 2023, CYE acquired Baseline's vulnerability analysis platform from Cyberillium, which added automated attack route creation and prioritization to the Hyver platform.

**About the Author**

Contributing Writer

Jeffrey Schwartz is a journalist who has covered information security and all forms of business and enterprise IT, including client computing, data center and cloud infrastructure, and application development for more than 30 years. Jeff is a regular contributor to Channel Futures. Previously, he was editor-in-chief of Redmond magazine and contributed to its sister titles Redmond Channel Partner, Application Development Trends, and Virtualization Review. Earlier, he held editorial roles with CommunicationsWeek, InternetWeek, and VARBusiness. Jeff is based in the New York City suburb of Long Island.

Exposure Management Provider CYE Acquires Solvo

Amateurish financial scams are common across Africa, and Namibia's influential former first lady, Monica Geingos, has emerged as a particularly effective host body for these messages.

Source: Sipa USA via Alamy Stock Photo

Scammers are using the likeness of Namibia's former first lady to trick people into falling for investment scams.

For some time now, Monica Geingos — first lady of Namibia from 2015 until her husband's passing early last year — has been warning Namibians about criminals using her likeness to perpetrate cheap financial scams. In a video posted online last week, Geingos reported an "uptick" in accounts impersonating her across social media platforms, with some using manipulated videos. Dark Reading has reached out to representatives of Mrs. Geingos for more information.

**Namibian Impersonation Scams**

Across Africa, as much as anywhere else on the globe, impersonation of political leaders, celebrities, and other generally influential figures feature prominently in investment scams.

Rachael Shitanda, vice chair of East Africa at the Africa Information & Communication Technologies Alliance (AfICTA), recalls a wealth of similar incidents affecting her home country of Kenya. "There were cases where fraudsters created fake social media accounts for Transport Cabinet Secretary Kipchumba Murkomen, promising job opportunities in exchange for 'processing fees.' These types of scams often target vulnerable job seekers. In another instance, fraudsters impersonated Deputy President Rigathi Gachagua in a fake investment scheme. They used doctored videos and photos to make the scam more convincing, leading several Kenyans to fall victim."

Geingos' combination of regional influence, having been voted one of Namibia's 12 most influential people in 2012 and one of Africa's 100 most influential women in 2020, and financial experience — she is a former employee of Namibia's Stock Exchange (NSX) and chairman of the board of eBank Namibia — make her a particularly effective vessel for these kinds of impersonation scams.

Source: Monica Geingos, The 3rd First Lady of Namibia on Facebook

Typically, scammers have impersonated Geingos on social media to promote fake foreign exchange (forex) trading platforms, or other forms of get-rich-quick schemes. Recently, Gengos said in her video, "Somebody received a video call, purportedly of me, convincing them to invest in some kind of weird forex \[foreign exchange\] schemes." These sorts of videos appear to be using real footage, dubbed over with fake audio intended to sound like a recording of her voice.

**Combating Online Scams in Africa**

These tricks seem to be working, as evidenced by the rising attacks against Geingos. "Something that has surprised \[my team\] of late is how ubiquitous it's become across social media platforms," she has said. And in one case, Geingos told the BBC, a woman who fell victim to one of these scams was swindled out of her retirement savings.

To Shitanda, there are a few main reasons why cyber scams might be particularly effective in Africa. First, law enforcement bodies have limited resources to fight rapidly evolving cyber threats. Plus, the criminals themselves operate across national borders, making them harder to track down and apprehend.

That said, Namibia's government has made some efforts to push back. Its state-owned Bank of Namibia founded a cybersecurity council aimed at combating online fraud in 2022, and a national cybercrime bill is currently undergoing a redrafting by the country's Ministry of Information and Communication Technology (MICT). Meanwhile, last summer, the International Criminal Police Organization (INTERPOL) concluded a major operation called First Light that, among targets in 60 other countries, busted up a scam ring in Namibia's capital city, Windhoek. Authorities seized hundreds of computers and mobile phones, and freed 88 children "who were forced into conducting scams."

Law enforcement aside, though, scammers are aided by more intractable core issues with how people engage with the Web. Digital literacy is lagging in some parts of the continent, Shitanda explains, and citizens of her country have a culture of trust in what they see: "People often believe messages from public figures without questioning their authenticity."

**About the Author**

Nate Nelson is a writer based in New York City. He formerly worked as a reporter at Threatpost, and wrote "Malicious Life," an award-winning Top 20 tech podcast on Apple and Spotify. Outside of Dark Reading, he also co-hosts "The Industrial Security Podcast."

Fake Videos of Former First Lady Scam Namibians

While Microsoft has boosted the security of Windows Print Spooler in the three years since the disclosure of the PrintNightmare vulnerability, the service remains a spooky threat that organizations cannot afford to ignore.

The 2021 PrintNightmare vulnerability exposed multiple deep-rooted security flaws in Microsoft's Print Spooler service, a core Windows component. The flaws, which had persisted in the Print Spooler for years, forced Microsoft to change the default behavior of the service and organizations to change how they enabled printing services for users. While Microsoft's changes have overall improved Print Spooler's security, researchers caution that the service remains a prime target for attackers. The potential weaknesses resulting from Microsoft's efforts to maintain backward compatibility with legacy code leaves Print Spooler vulnerable.

**A Critical Security Weakness**

PrintNightmare gave attackers a way to gain system-level privileges on affected systems, which included everything from domain controllers and Active Directory systems to lower-end servers and client systems. The flaw (CVE-2021-34527) stemmed from the Windows Print Spooler service improperly handling printer driver installations, allowing attackers to run arbitrary code, download malware, create new user accounts, or view, change, and delete data on affected systems.

The vulnerability arose from the service's failure to properly validate permissions for installing printer drivers, combined with its capability to accept remote connections via the Remote Procedure Call (RPC) protocol. This allowed attackers to remotely install malicious drivers and execute arbitrary code with elevated privileges, even from minimally privileged accounts. Researchers estimated that over 90% of Print Spooler environments at the time were impacted by PrintNightmare. The sheer scope of the threat prompted urgent calls from Microsoft, the US Cybersecurity and Infrastructure Security Agency (CISA), and others to apply immediate remediation measures.

"In the years following PrintNightmare, there have been exploits that have taken advantage of the remote aspect of the Print Spooler service," says Ben McCarthy, lead cyber security engineer at Immersive Labs.

There are a number of reasons why this is the case, he says, including the fact that the service is remotely accessible and allows for lateral movement.

"Furthermore, when large vulnerabilities are released, like PrintNightmare, it tips off hackers around the world that there may be more vulnerabilities in that component of Windows," McCarthy says. He also points to a report by researchers from China that described the internals of how Print Spooler worked as likely contributing to the discovery of multiple vulnerabilities in the service following the disclosure of PrintNightmare.

**Unprecedented Attention on Print Spooler Weaknesses**

The PrintNightmare vulnerability focused near unprecedented attention on the security of Microsoft's notoriously buggy Print Spooler service.

In the weeks and months following the disclosures, security researchers — many of them from Microsoft itself — uncovered as many as 11 Print Spooler vulnerabilities in 2021 alone. The first of these post-PrintNightmare Print Spooler vulnerabilities was CVE-2021-34481, a remote code execution vulnerability that Microsoft patched on July 15, 2021. The bug was publicly disclosed before Microsoft had a fix for it, but it did not end up getting exploited.

Like PrintNightmare, CVE-2021-34481 stemmed from the Windows Print Spooler service improperly handling printer driver installations, allowing attackers to load malicious drivers with system-level privileges. The flaw — and PrintNightmare before it — prompted Microsoft to change the default behavior of Point and Print, a Windows feature that lets users connect to network printers and automatically download and install the required printer drivers. Microsoft changed the default behavior to ensure that only users with administrative privileges could install new printers or update existing printer drivers.

The other Print Spooler related flaws discovered in 2021 were CVE-2021-34483, CVE-2021-36936, CVE-2021-36947, CVE-2021-36958, CVE-2021-36970, CVE-2021-38667, CVE-2021-38671, CVE-2021-40447, CVE-2021-1675, and CVE-2021-41332.

In total, Microsoft has disclosed some 53 Print Spooler related vulnerabilities since PrintNightmare was disclosed in 2021, says Satnam Narang, senior staff research engineer at Tenable. In addition to the 11 in 2021, Microsoft disclosed 35 in 2022, four in 2023, and three more in 2024. The three disclosed in 2024 were CVE-2024-21433, CVE-2024-38198, and CVE-2024-43529.

"Per the CISA Known Exploited Vulnerabilities \[KEV\] catalog, there were four Print Spooler vulnerabilities exploited in the wild," Narang says. All were from 2022:  CVE-2022-38028, CVE-2022-41073, CVE-2022-22718, and CVE-2022-21999.

Nearly half (45%) of these were disclosed by internal teams at Microsoft.

"It’s likely that this proactive, offensive approach led to the mitigation of many of the pathways to exploitation because we saw a steep decline in the number of reported Print Spooler vulnerabilities since \[2022\]," Narang says, pointing to the fact that Microsoft reported only seven Print Spooler vulnerabilities in total across 2023 and 2024.

Significantly, Microsoft has not disclosed a single remote code execution bug — usually the most severe — in its Print Spooler service since 2021, he adds. Instead, they have all have been an elevation of privilege bugs — which attackers typically leverage only after they have already gained initial access to a system — or information disclosure flaws. It's a positive development that likely is a result of all the research that has gone into finding vulnerabilities in the software since PrintNightmare, Narang says.

"From an outside-looking-in perspective, it appears that PrintNightmare was the catalyst for shoring up security within the Windows Print Spooler, making it increasingly difficult for attackers to exploit," Narang says.

**A Persistent Threat**

Even so, it's a mistake to take Print Spooler security for granted. The service remains a big target for attackers due to its complexity and integral role in the Windows operating system, says Mike Walters, president and co-founder of Action1. The service's legacy codebase and the need for backward compatibility also continue to present ongoing challenges, he notes.

The fact that the service is remotely accessible by any user is another reason Print Spooler remains a target of interest for attackers, adds Ben McCarthy, lead cyber security engineer at Immersive Labs. Flaws in the service give attackers an opportunity for lateral movement and privilege escalation, he says.  

"The Print Spooler service handles print jobs and communicates with printers, often using RPC for interprocess and network interactions, which introduces a broad attack surface," McCarthy says. "Vulnerabilities often arise from unchecked inputs, weak \[access control lists\], and improper handling of permissions, allowing attackers to exploit these mechanisms to execute arbitrary code or gain system-level privileges."

One notable example of the sustained and ongoing attacker interest in Print Spooler vulnerabilities is Russia-based APT28's use of CVE-2022-38028 in a privilege escalation and credential stealing campaign that targeted North American, European, and Ukrainian government organizations last April. Another indication of the broad researcher interest in the service is the fact that it was the US National Security Agency (NSA) that reported at least three Print Spooler vulnerabilities to Microsoft since PrintNightmare: CVE-2022-29104, CVE-2023-21678, and CVE-2022-38028.

For the most part, most attacks on Print Spooler bugs since PrintNightmare have simply been variations of existing and previously known attack vectors, according to Walters. Many of the vulnerabilities discovered in 2021, 2022, 2023, and 2024 are privilege escalation or remote code execution flaws that exploit similar vulnerabilities \[as\] PrintNightmare, such as improper input validation, inadequate permission checking, and the ability to load malicious drivers, Walters points out.

However, Microsoft's desire to maintain backward compatibility with legacy code has left the company addressing Print Spooler vulnerabilities at the protocol and function handler side. So expect to see researchers continuing to pound away at PrintNightmare-like bugs in Print Spooler, Walters says.

**Microsoft's Changes to Point and Print**

Besides issuing patches and offering mitigation advice for specific Print Spooler vulnerabilities, Microsoft has taken other steps to mitigate Print Spooler risks since PrintNightmare. One of the most significant is the change the company made to the default behavior of the Point and Print function associated with Print Spooler. The feature, designed to simplify the installation of printers for end users, originally allowed a user to connect to network printers and automatically download and install the required printer drivers without needing administrative privileges. Following PrintNightmare and CVE-2021-34481, Microsoft changed the feature's default behavior to ensure only users with administrative rights could do printer driver installation and updates.

At the time, Microsoft acknowledged the change could disrupt existing practices at organizations. "However, we strongly believe that the security risk justifies this change," it noted.

"Microsoft introduced the 'RestrictDriverInstallationToAdministrators' registry key and the corresponding Group Policy setting. When enabled, it enforces that only administrators can install printer drivers through Point and Print," Walters notes. Microsoft also disabled inbound remote printing by default on certain systems and strengthened the requirement for printer drivers to be digitally signed by a trusted certificate authority and some others, he notes.

In addition, new Group Policy settings that Microsoft introduced after PrintNightmare allow administrators to enforce strict controls over the print spooler service, including limiting which servers can deliver print jobs or drivers, Walters says.

"Disabling certain features by default, such as inbound remote printing, helps minimize the attack surface for systems that do not need such functionality," he notes.

PrintNightmare presented a challenge for Microsoft because fixing it required architectural changes that impacted many organizations around the world. 

"The biggest change that affected many sysadmins was the change to the way users can connect to remote printers," McCarthy says. "This necessary change means that any further exploits found in this particular part of the Print Spooler service will require the attacker to be the administrator first."

**Mitigation Measures**

Print Spooler is part of Windows OS and is enabled by default on many systems, including ones where it is generally not required, such as domain controllers. It typically runs as a privileged service, meaning it has system-level privileges, making it a high value target for attackers. Organizations can disable Print Spooler if they don't require any printing services — a somewhat rare situation in a business setting

A few mitigation measures are available for organizations struggling to completely disable Print Spooler services due to business requirements. Walters lists the following as the most effective among them:

*   Regularly install patches and updates released by Microsoft.
    
*   Configure Group Policy settings to allow only administrators to install printer drivers.
    
*   Disable incoming remote printing through Group Policy when not needed.
    
*   Use allow lists to specify approved printers and print servers.
    
*   Use security tools to monitor for suspicious activity related to the print spooler service.
    
*   Isolate print servers from critical systems to prevent lateral movement in the event of a compromise.
    
*   Deploy endpoint controls to prevent unauthorized code execution.
    

He also recommends that security administration restrict network access, segment networks with print servers, and enable secure RPC over SMB for the print spooler. In addition, consider disabling legacy protocols and features such as SMBv1 and enforce strong authentication mechanisms, Walters notes.

"It's clear that disabling Print Spooler services is not feasible in its entirety," Tenable's Narang says. "But ensuring that security updates are being applied, which often include changes like the ones noted in the July 2021 out-of-band release for PrintNightmare, is the best way to safeguard against these attacks."

PrintNightmare Aftermath: Windows Print Spooler Is Better. What's Next?

The threat actor is using a sophisticated network of VPNs and proxies to centrally manage command-and-control servers from Pyongyang.

Source: DC Studio via Shutterstock

An ongoing investigation into recent attacks by North Korea's Lazarus group on cryptocurrency entities and software developers worldwide has uncovered a hidden administrative layer that the threat actor has been using to centrally manage the campaign's command-and-control (C2) infrastructure.

The investigation by researchers at SecurityScorecard showed Lazarus using the newly discovered infrastructure to maintain direct oversight over compromised systems, control payload delivery on them, and efficiently manage exfiltrated data. Significantly, the threat actor is using the same Web-based admin platform in other campaigns, including one involving the impersonation of IT workers, the security vendor found.

**Elaborate Operational Security**

Though the threat actor has implemented elaborate operational security measures to try and evade attribution, SecurityScorecard said it was able to tie the campaign and infrastructure to North Korea with a high degree of confidence.

"\[The\] analysis makes it evident that Lazarus was orchestrating a global operation targeting the cryptocurrency industry and developers worldwide," SecurityScorecard said in a report this week. "The campaigns resulted in hundreds of victims downloading and executing the payloads, while, in the background, the exfiltrated data was being siphoned back to Pyongyang."

SecurityScorecard discovered "Phantom Circuit," the name by which it is tracking Lazarus group's newly discovered admin layer, while conducting followup investigations involving "Operation 99," a malicious campaign that it recently uncovered targeting the cryptocurrency industry and developers globally. In the campaign, members of the threat group have been posing as recruiters on LinkedIn and other online job forums to get software developers to engage in spurious project tests and code reviews.

Victims who fall for the scam are directed to clone a seemingly benign but harmful open source GitHub repository. The cloned repository connects to Lazarus group's C2 infrastructure, which the threat actor has then been using to sneak data-stealing malware into the victim's environment. As part of the campaign, Lazarus group actors have been inserting obfuscated backdoors into legitimate software products — including authentication apps and cryptocurrency software — and trying to trick developers into running them in their environments. SecurityScorecard estimates that more than 230 victims have downloaded the malicious payloads in the North Korean threat actor's latest campaign.

**Dual Motivations**

"The motivation is twofold: cryptocurrency theft and infiltration of corporate networks," Ryan Sherstobitoff, senior vice president of threat intelligence at SecurityScorecard says. More often than not, developers who fall victim to Lazarus group lures end up executing the cloned code on their corporate devices and in their work environments. "The payloads are designed to exfiltrate development secrets," he says.

SecurityScorecard uncovered the Phantom Circuit admin layer when trying to understand how Lazarus actors were managing the information they stole via Operation 99. What the company discovered was Lazarus members using what it described as a sophisticated network of Astrill VPNs and proxies to access Operation 99's C2 infrastructure in a highly concealed manner. Astrill, which has VPN servers in 142 cities and 56 countries, has a reputation for allowing users to browse the Web anonymously and bypass Internet restrictions in countries with heavy censorship.

SecurityScorecard researchers found Lazarus members using Astrill VPNs to connect to an intermediate proxy network registered with a freight company in Hasan, Russia. They then used the proxy network to connect to Operation 99's C2 infrastructure in an elaborate attempt to try and hide their tracks. The C2 servers themselves were hosted on infrastructure registered with a most likely fictional "Stark Industries, LLC."

"\[SecurityScorecard\] assesses with high confidence that the IPs used to connect to the C2s were merely a relay/proxy and used to obfuscate the true origin," the company wrote in its report this week. "The adversary was establishing a secondary session after connecting to the VPN with the proxy, thus obscuring the true origin of where they actually connected from." SecureScorecard said it was able to identify a total of six distinct IP addresses in Pyongyang that the threat actor used to initiate the Astrill VPN connections to Operation 99's C2 network.

"Phantom Circuit \[is the\] operational network behind the scenes that leads directly back to Pyongyang," Sherstobitoff says. It is also the same proxy network, he adds, that Lazarus used in another campaign where members used stolen identities to impersonate IT workers to try and secure jobs at organizations they wanted to infiltrate.

**About the Author**

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill.

Researchers Uncover Lazarus Group Admin Layer for C2 Servers

VulnCheck initially disclosed the critical command-injection vulnerability (CVE-2024-40891) six months ago, but Zyxel has yet to mention its existence or offer users a patch to mitigate threats.

Source: Timon Schneider via Alamy Stock Photo

NEWS BRIEF

A command-injection vulnerability in Zyxel CPE Series devices is being targeted by threat actors, and there's no patch available.

The bug, tracked as CVE-2024-40891, was first discovered by VulnCheck, a vulnerability intelligence firm, and disclosed to the vendor last July. Half a year later, Zyxel has yet to fix or even mention the vulnerability.

If successfully exploited, CVE-2024-40891 could allow threat actors to execute arbitrary commands on infected devices, ultimately potentially leading to system compromise, network infiltration, and data leaks, according to VulnCheck.

Researchers at GreyNoise meanwhile have been coordinating with the researchers at VulnCheck regarding exploitation of the vulnerability, and decided to disclose it publicly this week due to the "large number of attacks" they have been observing.

They also noted that CVE-2024-40891 is very similar to a known issue tracked as CVE-2024-40890, with the primary difference between the two being one is telnet-based and the other HTTP-based. Both, however, allow unauthenticated attackers to execute arbitrary commands using service accounts, whether in the "supervisor" or "zyuser" roles.

The lack of a patch could be a significant issue: Censys is reporting more than 1,500 vulnerable devices online, and it looks like some botnet operators have built exploits for the bug into their code, according to GreyNoise.

"After identifying a significant overlap between IPs exploiting CVE-2024-40891 and those classified as Mirai, the team investigated a recent variant of Mirai and confirmed that the ability to exploit CVE-2024-40891 has been incorporated into some Mirai strains," the researchers noted.

Since there is no current fix, GreyNoise recommended that users filter traffic for unusual requests to Zyxel CPE management interfaces, monitor Zyxel's security updates to be aware if a patch is made available, restrict administrative interface access to trusted IPs, and disable unused remote management features.

**About the Author**

Skilled writer and editor covering cybersecurity for Dark Reading.

Unpatched Zyxel CPE Zero-Day Pummeled by Cyberattackers

Yet another spinoff of the infamous DDoS botnet is exploiting a known vulnerability in active attacks, while its threat actors are promoting it on Telegram for other attackers to use as well, in a DDoS-as-a-service model.

Source: Kirill Ivanov via Alamy Stock Photo

Yet another Mirai botnet variant is making the rounds, this time offering distributed denial-of-service (DDoS) as-a-service by exploiting flaws in Mitel SIP phones. It also features a unique capability to communicate with attacker command-and-control (C2).

Researchers at the Akamai Security Intelligence and Response Team (SIRT) identified the variant of the infamous botnet, dubbed Aquabot, that actively exploits CVE-2024-41710, a command-injection vulnerability that affects various Mitel models that are used in corporate environments, they revealed in a blog post published Jan. 29. The vulnerability relies on an input sanitization flaw, and exploitation can lead to root access of the device, SIRT researchers Kyle Lefton and Larry Cashdollar wrote in the post.

The variant is the third version of Aquabot (Akamai calls it Aquabotv3) to appear on the scene; the first version was built off the Mirai framework with the ultimate goal of DDoS, discovered in November 2023, and it was first reported by Antiy Labs. The second version of the bot "tacked on concealment and persistence mechanisms, such as preventing device shutdown and restart" that remain present in v3, the researchers wrote.

The new variant is distinct from the previous versions for a couple of reasons, the researchers said. One is a unique feature appearing first in Aquabotv3: a function named "report\_kill" that reports back to the C2 when a kill signal is caught on the infected device. So far, however, researchers have not seen any response to the function from the attacker C2.

Related:Unpatched Zyxel CPE Zero-Day Pummeled by Cyberattackers

Another notable aspect of v3 of Aquabot is that the threat actors behind it have been advertising the botnet as DDoS as-a-service through platforms such as Telegram. The bot is advertised under several different names — including Cursinq Firewall, The Eye Services, and The Eye Botnet — offering Layer 4 and Layer 7 DDoS, the researchers noted.

**Active Exploitation of Mitel Phone Security Flaw**

Akamai SIRT detected exploit attempts targeting CVE-2024-41710 through its global network of honeypots in early January using a payload almost identical to a proof-of-concept (PoC) developed and released on GitHub in mid-August by Packetlabs' researcher Kyle Burns.

Burns discovered that the Mitel 6869i SIP phone, firmware version 6.3.0.1020, failed to sanitize user-supplied input properly, with multiple endpoints vulnerable to the flaw. His PoC demonstrated that an attacker could smuggle in entries otherwise blocked by the application's sanitization checks by sending a specially crafted HTTP POST request.

Related:Super Bowl LIX Could Be a Magnet for Cyberattacks

The exploitation activity that Akamai SIRT observed delivered a payload that attempts to fetch and execute a shell script called :bin.sh, which will in turn fetch and execute Mirai malware on the target system, the researchers wrote. The malware has support for a variety of different architectures, including x86 and ARM.

"Based on our analysis of the malware samples, we determined that this is a version of the Aquabot Mirai variant," specifically the latest evolution of the malware, Aquabotv3, the researchers wrote in the post.

In addition to being used in DDoS attacks, threat actors also are hawking Aquabot for DDoS-as-a-service, though they are trying to disguise the activity as "purely testing" for DDoS mitigation. However, the same domain featured in the ad promoting testing is actively spreading Mirai malware, the researchers noted.

"Threat actors will claim it's just a \[proof of concept\] or something educational, but a deeper analysis shows that they are in fact advertising DDoS as a service, or the owners are boasting about running their own botnet on Telegram," they wrote in the post.

**Mirai Botnet Remains Key Conduit for DDoS**

As the majority of botnets responsible for DDoS attacks are based on Mirai, "they predominantly target Internet of Things (IoT) devices, which makes spreading the malware relatively easy to do," the researchers noted in the post. Indeed, a recent wave of global DDoS attacks were attributed to Mirai botnet spinoffs, demonstrating that attackers aiming to leverage Mirai show no signs of slowing down.

Related:Apple Patches Actively Exploited Zero-Day Vulnerability

That's likely because "the \[return on investment\] of Mirai for an aspiring botnet author is high," because it's not only one of the most successful botnet families in the world, it's also one of the more simple ones to modify, the researchers noted.

Moreover, many IoT devices often lack proper security features, are at the end of service, or are left with default configurations and passwords either from neglect or lack of knowledge about the dangers, making them low-hanging fruit for Mirai and its variants, the researchers wrote.

No matter what an attacker's intentions are, the researchers recommended that organizations take action to secure IoT devices through discovery or changing default credentials to protect against DDoS threats.

"Many of these botnets rely on common password libraries for authentication," they wrote in the post. "Find out where your known IoT devices are, and check for rogue ones, too. Check the login credentials and change them if they are default or easy to guess."

Akamai SIRT also included a list of indicators of compromise (IoCs) as well as Snort and Yara rules in the post to aid defenders.

**About the Author**

Elizabeth Montalbano is a freelance writer, journalist, and therapeutic writing mentor with more than 25 years of professional experience. Her areas of expertise include technology, business, and culture. Elizabeth previously lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City; she currently resides in a village on the southwest coast of Portugal. In her free time, she enjoys surfing, hiking with her dogs, traveling, playing music, yoga, and cooking.

Mirai Variant 'Aquabot' Exploits Mitel Device Flaws

Managing third-party risk in the SaaS era demands a proactive, data-driven approach beyond checkbox compliance.

Source: Olekcii Mach via Alamy Stock Photo

COMMENTRY

In June 2023, the MOVEit supply chain attack served as a harsh reminder of the vulnerabilities in our software-as-a-service (SaaS) ecosystem. Third-party risk management (TPRM) in today's world of SaaS applications is no longer just about ticking boxes on a checklist. The old methods, with their static questionnaires and outdated ISO 27001 and System and Organization Controls (SOC) — SOC 1, SOC 2, and SOC 3 — reports are simply not efficient anymore. With cyber threats, such as supply chain attacks and third-party integration exploits, becoming more sophisticated, organizations need a dynamic approach to managing SaaS vendors. Embracing automation, real-time visibility, and targeted assessments are crucial steps to stay ahead of potential risks.

Let's explore how organizations that rely heavily on SaaS apps can evolve their TPRM strategies to face modern security challenges head-on.

**The Growing Complexity of SaaS Oversight**

SaaS adoption is growing rapidly, bringing organizations convenience and flexibility. According to B2BSaaS estimates, the SaaS market was valued at $273.5 billion in 2023 and is expected to grow to $1.2 trillion by 2032. However, this growth also comes with an expanded attack surface and more complex data flows. For organizations handling sensitive customer data and navigating strict regulations, these challenges are critical.

Two trends amplify these challenges:

*   Explosion of SaaS apps: Companies use hundreds of SaaS and cloud apps, many introduced without official approval, complicating security oversight. Shadow IT often results in blind spots, making it harder to assess overall security.
    
*   Evolving threat landscape: Attackers increasingly target third-party vendors. Generative AI (GenAI) has further complicated the landscape, enabling attackers to enhance tactics and exploit integration points, misconfigured cloud services, and stolen credentials. The Okta breach of 2023 demonstrated the potential scale of damage from a supply chain attack.
    

These challenges highlight the inadequacy of relying solely on traditional security questionnaires and annual SOC 2 reports. Continuous visibility into vendors' security practices is essential for effective risk management.

**The Problem With Traditional Third-Party Risk Reviews**

Traditional risk reviews involve substantial manual effort and fall short in addressing modern threats:

*   Inefficient manual processes: Manually sending, tracking, and analyzing vendor questionnaires consumes excessive time and energy and delays the resolution of security issues.
    
*   Superficial questions: Generic Yes/No queries (e.g., "Do your developers follow secure coding practices?") fail to assess the effectiveness of vendors' security measures. More specific questions, tied to real-world scenarios, often yield actionable insights.
    
*   Outdated reports: Reports like ISO 27001 and SOC 2 quickly become obsolete in evolving SaaS environments. The emergence of GenAI has further accelerated the pace of change, necessitating updated, dynamic assessments.
    

**Evolving TPRM to Handle Modern SaaS Challenges**

To tackle these issues, organizations must adopt agile, data-centric approaches to vendor security:

1.  Embrace real-time assurance through trust centers. SOC 2 reports are a starting point, but critical vendors should offer ongoing visibility through automated trust centers. Tools like Sprinto, Drata, and Vento provide real-time insights into security controls and compliance, enabling proactive decisions.
    

1.  Make questionnaires smarter. Replace generic questionnaires with tailored assessments that probe deeper. Focus on how controls are implemented and monitored. For example, shift from "Do you secure ABC?" to "How do you secure ABC, and how do you verify its effectiveness?" Questions that examine metrics and outcomes help uncover the true state of security.
    
2.  Address talent gaps and boost technical expertise. Invest in developing skills in cloud security, SaaS configuration, and API management. Training internal teams or partnering with specialized vendors can bridge expertise gaps. The SolarWinds breach of 2020 underscores the need for visibility into supply chain vulnerabilities. Workshops and certifications can enhance team capabilities, keeping them informed of evolving risks.
    
3.  Include shadow IT and "free" tools. Review unpaid apps, open source tools, and browser extensions — often overlooked but risky. Shadow IT tools, while offering productivity, introduce unknown risks. Assessing these apps before they integrate into workflows reduces unexpected exposure. Include them in audits to ensure they meet baseline security standards.
    
4.  Use modern tools, not spreadsheets. Transition from spreadsheets to SaaS security posture management (SSPM) tools, which monitor misconfigurations, excessive permissions, and suspicious activities. AI-powered tools can further analyze vendor responses and highlight inconsistencies. Leveraging these tools saves time and enhances accuracy.
    

**What Can You Do When Revamping Your TPRM Strategy**

Evolving TPRM processes isn't easy. Avoid common pitfalls:

*   Avoid risky inaction: Delaying updates to vendor management increases exposure. Start with small, impactful improvements and scale gradually.
    
*   Avoid overcommitting resources: Implement changes incrementally, prioritizing high-impact areas. This ensures resource efficiency without overwhelming teams.
    
*   Set realistic expectations for AI: Leverage AI where it adds value while recognizing its limitations. AI tools should complement, not replace, human oversight.
    
*   Ensure team alignment: Align team skills with new vendor security goals. Equip teams to manage technical assessments effectively. Feedback loops can ensure continuous improvement and alignment with organizational objectives.
    

**What We Can Take From This**

Managing third-party risk in the SaaS era demands a proactive, data-driven approach. Organizations must go beyond checkbox compliance by leveraging real-time assurance, tailored assessments, and automation. Modernizing TPRM is essential to address the complexities of SaaS security.

While challenging, particularly for smaller organizations, the benefits of preventing breaches and protecting reputations outweigh the costs. Organizations can manage expenses effectively by prioritizing critical vendors and adopting phased changes while enhancing third-party risk management. The commitment to proactive strategies ensures resilience against an ever-evolving threat landscape.

**About the Author**

Information Security Officer, IMC Trading

Jatin Mannepalli, CISSP, CCSP is an information security officer (ISO) at IMC Trading, where he brings a deep commitment to managing security and risk across organizations. With more than 10 years of experience in the InfoSec space, he has built and led information security and risk management teams, and has also worked as a security consultant for major consulting firms like McKinsey & Company. Jatin is passionate about security governance and risk management, as well as developing technology-driven, customer-focused strategies that prioritize both organizational success and client satisfaction. Known for his holistic approach, he is dedicated to fostering a culture of security that aligns with the organization’s broader goals. In addition to his professional accomplishments, Jatin is recognized as one of the top voices in Information Security on LinkedIn. In his leisure time, he volunteers to promote security awareness in local communities and contributes to the cybersecurity community by helping develop exams for ISC2.

Source

DARKReading