Loading malware…
SpoolFool is a local privilege escalation proof-of-concept tool that exploits CVE-2022-21999, the Windows Print Spooler Elevation of Privilege vulnerability. In the provided reporting, it was used as part of intrusion activity tracked by Unit 42 as cluster CL-STA-0046, which they attributed with moderate confidence to the Gelsemium APT group. The activity targeted a Southeast Asian government environment and included compromised IIS servers, web shells such as reGeorg, China Chopper, and AspxSpy, and post-exploitation tooling including OwlProxy, SessionManager, Cobalt Strike, Meterpreter, EarthWorm, and Potato Suite variants. SpoolFool was specifically used in an attempt to elevate privileges and create a local administrator account named "admin" with the default password "Passw0rd!". The content describes SpoolFool as a GitHub-published LPE PoC and notes it among the more common tools used by the attackers. High-confidence details directly mentioned are limited to its role as an LPE tool exploiting CVE-2022-21999 in this espionage-focused campaign.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
GitHub-published local privilege escalation PoC targeting the Windows Print Spooler to elevate privileges (e.g., to create a local admin user).
Tool used to exploit Windows Print Spooler-related weaknesses for privilege escalation (as used in the described intrusion set).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.