FBI, CISA Warn of Russian Hackers Exploiting MFA and PrintNightmare Bug

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have unveiled a joint advisory warning that Russia-backed menace actors hacked the network of an unnamed non-governmental entity by exploiting a mix of flaws.

“As early as Might 2021, Russian state-sponsored cyber actors took edge of a misconfigured account established to default [multi-factor authentication] protocols at a non-governmental business (NGO), making it possible for them to enroll a new system for MFA and access the target network,” the organizations stated.

“The actors then exploited a critical Windows Print Spooler vulnerability, ‘PrintNightmare’ (CVE-2021-34527) to run arbitrary code with system privileges.”

The attack was pulled off by attaining initial entry to the sufferer organization via compromised credentials – acquired by indicates of a brute-force password guessing attack – and enrolling a new unit in the organization’s Duo MFA.

It is really also noteworthy that the breached account was un-enrolled from Duo due to a extensive interval of inactivity, but experienced not yet been disabled in the NGO’s Lively Directory, thereby making it possible for the attackers to escalate their privileges using the PrintNightmare flaw and disable the MFA assistance altogether.

“As Duo’s default configuration settings permit for the re-enrollment of a new system for dormant accounts, the actors have been capable to enroll a new machine for this account, comprehensive the authentication specifications, and attain access to the victim network,” the agencies described.

Turning off MFA, in switch, allowed the condition-sponsored actors to authenticate to the NGO’s virtual personal network (VPN) as non-administrator customers, link to Windows domain controllers through Distant Desktop Protocol (RDP), and obtain credentials for other domain accounts.

In the final stage of the attack, the newly compromised accounts ended up subsequently used to shift laterally across the network to siphon details from the organization’s cloud storage and email accounts.

To mitigate these attacks, both CISA and FBI are recommending organizations to implement and assessment multi-factor authentication configuration guidelines, disable inactive accounts in Lively Directory, and prioritize patching for identified exploited flaws.

Located this posting fascinating? Follow THN on Facebook, Twitter  and LinkedIn to go through additional unique content material we write-up.

Some pieces of this post are sourced from:
thehackernews.com