Windows Print Spooler CVE-2022-38028: GRU's GooseEgg Tool

What to do

1. Confirm every Windows host has an October 2022 or later update by reading its build and UBR.
2. Disable the Print Spooler service on domain controllers, as Microsoft recommends.
3. Confirm the PrintNightmare fixes (CVE-2021-1675, CVE-2021-34527) are also installed.
4. Turn on the ASR rule that blocks credential stealing from lsass.exe.
5. Replace Windows 8.1 and Server 2012/2012 R2 machines, or keep 2012-era servers on ESU.

How to check if you are affected or compromised

• Run schtasks /query /tn "\Microsoft\Windows\WinSrv"; Microsoft saw GooseEgg use this task to run C:\ProgramData\servtask.bat as SYSTEM every minute.
• Look for execute.bat, doit.bat or servtask.bat in C:\ProgramData, justice.exe or DefragmentSrv.exe, and version-style folders such as C:\ProgramData\Adobe\v2.116.4405.
• Search EDR data for new .js files under C:\Windows\System32\DriverStore\FileRepository and for the CLSID {026CC6D7-34B2-33D5-B551-CA31EB6CE345} or a PROTOCOLS\Handler\rogue key under HKCU\Software\Classes.
• Check antivirus history for HackTool:Win64/GooseEgg.

What happened#

On October 11, 2022, Microsoft fixed CVE-2022-38028, an elevation-of-privilege bug in the Windows Print Spooler. A user who can already run code on a machine can use it to gain SYSTEM. Microsoft rated it Important, CVSS 3.1 7.8, and credited the US National Security Agency with the report. At release Microsoft said the bug was neither public nor exploited, but rated exploitation "more likely".

Eighteen months later, on April 22, 2024, Microsoft Threat Intelligence showed who had been using it. Forest Blizzard, which the US and UK governments link to Unit 26165 of Russia's GRU and which others call APT28, exploited the bug with a custom tool Microsoft calls GooseEgg. Microsoft says the group has used the tool "since at least June 2020 and possibly as early as April 2019". Microsoft does not call it a zero-day, but that timeline starts well before the fix. Targets were government, non-governmental, education and transportation organizations in Ukraine, Western Europe and North America.

The exploit is a file-path trick. GooseEgg copies two driver-store folders into a directory it controls and re-points the C: drive symbolic link in the Windows object manager to that directory. It then has the spooler load a modified JavaScript constraints file, MPDW-constraints.js, with SYSTEM rights, which launches the attacker's DLL. Microsoft calls GooseEgg "a simple launcher application" aimed at stealing credentials. One of its batch scripts saves and compresses registry hives. CISA added the CVE to the KEV catalog on April 23, 2024, with a May 14 federal deadline.

Who is affected#

Microsoft's October 2022 update data lists Windows 8.1 and RT 8.1, Windows 10 (1507, 1607, 1809, 20H2, 21H1, 21H2), Windows 11 (21H2, 22H2) and Windows Server 2012, 2012 R2, 2016, 2019 and 2022. Windows 7 and Server 2008 are not on the list. The CVE record gives the first fixed build per version, for example 20348.1129 for Server 2022. Any later update also contains the fix.

Do you really need to act?#

For most fleets this is a check, not an emergency. The fix is four years old, and an attacker needs a foothold first. Two things keep it relevant. First, several affected versions are out of support. Windows 8.1 ended on January 10, 2023, and Server 2012 and 2012 R2 on October 10, 2023, per Microsoft's lifecycle list. A machine that missed October 2022 and then left support may never have received the fix. Second, Forest Blizzard was after credentials. If you work in a targeted sector and had hosts exposed between 2020 and late 2022, the real question is whether credentials were taken then.

What to do now#

1. Confirm every Windows host runs an October 2022 or later update: Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object CurrentBuild, UBR.
2. Disable the spooler on domain controllers, which Microsoft says do not need it: Stop-Service Spooler; Set-Service Spooler -StartupType Disabled.
3. Confirm the PrintNightmare fixes for CVE-2021-1675 and CVE-2021-34527 are installed. Microsoft lists them alongside this one.
4. Turn on the attack surface reduction rule that blocks credential stealing from lsass.exe.
5. Replace Windows 8.1 and Server 2012-era machines, or keep the servers on ESU.

How to tell if you were hit#

• Run schtasks /query /tn "\Microsoft\Windows\WinSrv". Microsoft saw this task run C:\ProgramData\servtask.bat as SYSTEM every minute.
• Look for execute.bat, doit.bat or servtask.bat in C:\ProgramData, for justice.exe or DefragmentSrv.exe, and for version-style folders such as C:\ProgramData\Adobe\v2.116.4405.
• Search EDR data for newly created .js files under C:\Windows\System32\DriverStore\FileRepository\, and for HKCU\Software\Classes\CLSID\{026CC6D7-34B2-33D5-B551-CA31EB6CE345} or HKCU\Software\Classes\PROTOCOLS\Handler\rogue.
• Check antivirus history for HackTool:Win64/GooseEgg. On any hit, reset credentials used on that host.

Timeline#

• June 2020 — Earliest confirmed GooseEgg use, per Microsoft (possibly April 2019).
• Oct 11, 2022 — Microsoft fixes CVE-2022-38028, credited to the NSA.
• Jan 10, 2023 — Windows 8.1 reaches end of support.
• Oct 10, 2023 — Windows Server 2012 and 2012 R2 reach end of support.
• Apr 22, 2024 — Microsoft publishes its GooseEgg analysis.
• Apr 23, 2024 — CISA adds the CVE to KEV.
• May 14, 2024 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2022-38028 · KEV 2024-04-23 · Windows Print Spooler Elevation of Privilege Vulnerability

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft — Security Update Guide: CVE-2022-38028 Windows Print Spooler Elevation of Privilege Vulnerability msrc.microsoft.com
2. Microsoft — October 2022 Security Updates (CVRF) api.msrc.microsoft.com
3. Microsoft Threat Intelligence — Analyzing Forest Blizzard's custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials microsoft.com
4. CVE record — CVE-2022-38028 cve.org
5. NVD — CVE-2022-38028 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2022-38028 cisa.gov
7. Microsoft Learn — Ending Support in 2023 learn.microsoft.com