---
title: "Windows Print Spooler CVE-2022-38028: GRU's GooseEgg Tool"
url: https://erroneo.us/security/briefs/windows-print-spooler-cve-2022-38028-gooseegg/
description: "A Print Spooler privilege-escalation bug fixed in Oct 2022 that Russia's GRU exploited with GooseEgg; KEV since Apr 2024. Confirm patches, hunt for GooseEgg."
type: security-brief
section: "Security Digest"
date_published: 2022-10-11
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2022-38028"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Windows Print Spooler CVE-2022-38028: GRU's GooseEgg Tool

**Verdict: Check exposure.** Any Windows update since October 2022 fixes this; the remaining work is finding hosts that never got it, turning the spooler off on domain controllers, and checking for GooseEgg where Forest Blizzard may have been active.

- **Who must act:** Owners of Windows hosts with no update since October 2022, especially unsupported Windows 8.1 and Server 2012/2012 R2 machines, and government, NGO, education and transportation organizations in Ukraine, Europe and North America.
- **Who can relax:** Fleets that have installed any monthly update since October 11, 2022; Windows 7 and Server 2008 are not in Microsoft's affected list.
- **Affected:** Windows 8.1 and Windows RT 8.1; Windows 10 1507, 1607, 1809, 20H2, 21H1 and 21H2 before the October 2022 update; Windows 11 21H2 and 22H2 before builds 22000.1098 / 22621.674; Windows Server 2012, 2012 R2, 2016, 2019 and 2022 before the October 2022 update
- **Fixed:** KB5018421 (Server 2022, build 20348.1129); KB5018419 (Windows 10 1809 / Server 2019, build 17763.3532); KB5018411 (Windows 10 1607 / Server 2016, build 14393.5427); KB5018474 monthly rollup or KB5018476 security-only (Windows 8.1 / Server 2012 R2); Any later cumulative update
- **CVEs:** CVE-2022-38028
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Confirm every Windows host has an October 2022 or later update by reading its build and UBR.
2. Disable the Print Spooler service on domain controllers, as Microsoft recommends.
3. Confirm the PrintNightmare fixes (CVE-2021-1675, CVE-2021-34527) are also installed.
4. Turn on the ASR rule that blocks credential stealing from lsass.exe.
5. Replace Windows 8.1 and Server 2012/2012 R2 machines, or keep 2012-era servers on ESU.

### How to check if you are affected

- Run schtasks /query /tn "\Microsoft\Windows\WinSrv"; Microsoft saw GooseEgg use this task to run C:\ProgramData\servtask.bat as SYSTEM every minute.
- Look for execute.bat, doit.bat or servtask.bat in C:\ProgramData, justice.exe or DefragmentSrv.exe, and version-style folders such as C:\ProgramData\Adobe\v2.116.4405.
- Search EDR data for new .js files under C:\Windows\System32\DriverStore\FileRepository and for the CLSID {026CC6D7-34B2-33D5-B551-CA31EB6CE345} or a PROTOCOLS\Handler\rogue key under HKCU\Software\Classes.
- Check antivirus history for HackTool:Win64/GooseEgg.

## What happened

On October 11, 2022, Microsoft fixed [CVE-2022-38028](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38028), an elevation-of-privilege bug in the Windows Print Spooler. A user who can already run code on a machine can use it to gain SYSTEM. Microsoft rated it Important, CVSS 3.1 7.8, and credited the US National Security Agency with the report. At release Microsoft said the bug was neither public nor exploited, but rated exploitation "more likely".

Eighteen months later, on April 22, 2024, [Microsoft Threat Intelligence](https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/) showed who had been using it. Forest Blizzard, which the US and UK governments link to Unit 26165 of Russia's GRU and which others call APT28, exploited the bug with a custom tool Microsoft calls GooseEgg. Microsoft says the group has used the tool "since at least June 2020 and possibly as early as April 2019". Microsoft does not call it a zero-day, but that timeline starts well before the fix. Targets were government, non-governmental, education and transportation organizations in Ukraine, Western Europe and North America.

The exploit is a file-path trick. GooseEgg copies two driver-store folders into a directory it controls and re-points the C: drive symbolic link in the Windows object manager to that directory. It then has the spooler load a modified JavaScript constraints file, `MPDW-constraints.js`, with SYSTEM rights, which launches the attacker's DLL. Microsoft calls GooseEgg "a simple launcher application" aimed at stealing credentials. One of its batch scripts saves and compresses registry hives. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-38028) on April 23, 2024, with a May 14 federal deadline.

## Who is affected

Microsoft's [October 2022 update data](https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2022-Oct) lists Windows 8.1 and RT 8.1, Windows 10 (1507, 1607, 1809, 20H2, 21H1, 21H2), Windows 11 (21H2, 22H2) and Windows Server 2012, 2012 R2, 2016, 2019 and 2022. Windows 7 and Server 2008 are not on the list. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2022-38028) gives the first fixed build per version, for example 20348.1129 for Server 2022. Any later update also contains the fix.

## Do you really need to act?

For most fleets this is a check, not an emergency. The fix is four years old, and an attacker needs a foothold first. Two things keep it relevant. First, several affected versions are out of support. Windows 8.1 ended on January 10, 2023, and Server 2012 and 2012 R2 on October 10, 2023, per [Microsoft's lifecycle list](https://learn.microsoft.com/en-us/lifecycle/end-of-support/end-of-support-2023). A machine that missed October 2022 and then left support may never have received the fix. Second, Forest Blizzard was after credentials. If you work in a targeted sector and had hosts exposed between 2020 and late 2022, the real question is whether credentials were taken then.

## What to do now

1. Confirm every Windows host runs an October 2022 or later update: `Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object CurrentBuild, UBR`.
2. Disable the spooler on domain controllers, which Microsoft says do not need it: `Stop-Service Spooler; Set-Service Spooler -StartupType Disabled`.
3. Confirm the PrintNightmare fixes for CVE-2021-1675 and CVE-2021-34527 are installed. Microsoft lists them alongside this one.
4. Turn on the attack surface reduction rule that blocks credential stealing from `lsass.exe`.
5. Replace Windows 8.1 and Server 2012-era machines, or keep the servers on ESU.

## How to tell if you were hit

- Run `schtasks /query /tn "\Microsoft\Windows\WinSrv"`. Microsoft saw this task run `C:\ProgramData\servtask.bat` as SYSTEM every minute.
- Look for `execute.bat`, `doit.bat` or `servtask.bat` in `C:\ProgramData`, for `justice.exe` or `DefragmentSrv.exe`, and for version-style folders such as `C:\ProgramData\Adobe\v2.116.4405`.
- Search EDR data for newly created `.js` files under `C:\Windows\System32\DriverStore\FileRepository\`, and for `HKCU\Software\Classes\CLSID\{026CC6D7-34B2-33D5-B551-CA31EB6CE345}` or `HKCU\Software\Classes\PROTOCOLS\Handler\rogue`.
- Check antivirus history for `HackTool:Win64/GooseEgg`. On any hit, reset credentials used on that host.

## Timeline

- June 2020 — Earliest confirmed GooseEgg use, per Microsoft (possibly April 2019).
- Oct 11, 2022 — Microsoft fixes CVE-2022-38028, credited to the NSA.
- Jan 10, 2023 — Windows 8.1 reaches end of support.
- Oct 10, 2023 — Windows Server 2012 and 2012 R2 reach end of support.
- Apr 22, 2024 — Microsoft publishes its GooseEgg analysis.
- Apr 23, 2024 — CISA adds the CVE to KEV.
- May 14, 2024 — CISA's remediation deadline for federal agencies.

## Sources

1. [Microsoft — Security Update Guide: CVE-2022-38028 Windows Print Spooler Elevation of Privilege Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38028)
2. [Microsoft — October 2022 Security Updates (CVRF)](https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2022-Oct)
3. [Microsoft Threat Intelligence — Analyzing Forest Blizzard's custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials](https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/)
4. [CVE record — CVE-2022-38028](https://www.cve.org/CVERecord?id=CVE-2022-38028)
5. [NVD — CVE-2022-38028](https://nvd.nist.gov/vuln/detail/CVE-2022-38028)
6. [CISA — Known Exploited Vulnerabilities: CVE-2022-38028](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-38028)
7. [Microsoft Learn — Ending Support in 2023](https://learn.microsoft.com/en-us/lifecycle/end-of-support/end-of-support-2023)

---
Source page: https://erroneo.us/security/briefs/windows-print-spooler-cve-2022-38028-gooseegg/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt