Russia-linked APT28 group used a previously unknown tool, dubbed GooseEgg, to exploit Windows Print Spooler service flaw.

The malicious code allows attackers to steal credentials and perform other tasks. Microsoft says it appears to be unique to Russia's military intelligence agency, the GRU.

Microsoft says the launcher application is unique to Russia’s APT28 threat group and can lead to remote code execution.

ALT: a huge statue of liberty with a hulu logo on the bottom

Putin's pals use 'GooseEgg' malware to launch attacks you can defeat with patches or deletion

Putin's pals use 'GooseEgg' malware to launch attacks you can defeat with patches or deletion

Microsoft warns that the Russian APT28 threat group exploits a Windows Print Spooler vulnerability to escalate privileges and steal credentials and data using a previously unknown hacking tool called GooseEgg. APT28 has been using this tool to exploit the CVE-2022-38028 vulnerability since at least June 2020 and possibly as early as April 2019. Redmond fixed Microsoft warns that the Russian APT28 threat group exploits a Windows Print Spooler vulnerability to escalate privileges and steal credentials and data using a previously unknown hacking tool called GooseEgg.

Hackers linked to Russia have been exploiting a Windows bug for YEARS to deploy GooseEgg malware for escalating attack access.