PrintSpoofer
PrintSpoofer is a Windows local privilege-escalation tool/exploit used to elevate execution to NT AUTHORITY\SYSTEM by abusing token impersonation when SeImpersonatePrivilege is available. The provided content explicitly describes it being used to leverage SeImpersonatePrivilege on Windows Server 2016 and to escalate from lower-privileged service contexts such as IIS application pool identities and NT AUTHORITY\Network Service to SYSTEM. It is referenced alongside other privilege-escalation tooling such as PrintNightmare.
Observed usage in the content is post-compromise rather than initial access. In one walkthrough, an attacker obtained code execution as iis apppool\defaultapppool, verified SeImpersonatePrivilege with whoami /priv, downloaded PrintSpoofer64.exe, and executed it with '-i -c cmd' to obtain a SYSTEM shell. In another exploit chain involving CVE-2024-26230 in the Windows Telephony Service, a malicious DLL yielded NT AUTHORITY\Network Service execution, after which PrintSpoofer was used to escalate further to NT AUTHORITY\SYSTEM because the service token had SeImpersonatePrivilege.
The content also ties PrintSpoofer to multiple threat activities. Palo Alto Networks Unit 42 reported CL-UNK-1068 using PrintSpoofer in intrusions targeting high-value organizations across South, Southeast, and East Asia, including aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications sectors. In those intrusions, PrintSpoofer appeared among payloads executed via DLL side-loading with legitimate Python executables, alongside FRP and the custom Go-based scanner ScanPortPlus. Separate reporting in the content states Earth Longzhi, a subgroup of APT41, used PrintSpoofer during post-exploitation in campaigns from 2020 to 2022 targeting sectors including government, healthcare, infrastructure, banking, defense, aviation, insurance, and urban development across Taiwan and other Asia-Pacific countries.
High-confidence indicators and execution details directly mentioned in the content include the binary name PrintSpoofer64.exe and the command line 'PrintSpoofer64.exe -i -c cmd'.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2024-26230 is a critical vulnerability found in the Windows Telephony Service (TapiSrv), which can lead to an elevation of privilege on affected systems. The exploit leverages a use-after-free in FreeDialogInstance.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
During the investigation of the second campaign, we collected multiple hacking tools used for privilege escalation (PrintNightmare and PrintSpoofer)
“The attackers used this technique to load and execute several tools as payloads, including FRP, PrintSpoofer…”
Techniques & procedures
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
1 technique
Execution
Privilege Escalation
3 techniques
Privilege Escalation
we collected multiple hacking tools used for privilege escalation (PrintNightmare and PrintSpoofer)
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Windows privilege escalation tool commonly used post-compromise to obtain elevated privileges.
Open-source Windows local privilege escalation tool abused to elevate privileges (also used alongside a custom .NET variant, PrintProgram).
Local privilege escalation tool that abuses SeImpersonatePrivilege (via named pipe/token impersonation) to spawn a process as SYSTEM on Windows (commonly used on Server 2016).
A Windows privilege escalation exploit/tool used to abuse SeImpersonate privilege to elevate from Network Service to SYSTEM.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.