Loading story…
Microsoft disclosed that the Russian state-linked threat actor Forest Blizzard—also tracked as APT28, STRONTIUM, Fancy Bear, Sednit, and Sofacy—used a custom post-compromise tool called GooseEgg to escalate privileges on compromised Windows systems. The activity targeted government, NGO, education, and transportation organizations in Ukraine, Western Europe, and North America, and has been observed since at least June 2020, with possible activity dating back to April 2019. Microsoft linked the group to GRU Unit 26165, consistent with prior US and UK government attributions.
According to Microsoft, GooseEgg exploited CVE-2022-38028 in the Windows Print Spooler by modifying a JavaScript constraints file and abusing a rogue protocol handler so a malicious DLL could run as SYSTEM through the Print Spooler process. The tool was used as a launcher for DLLs or executables, enabling credential theft, remote code execution, persistence, backdoor installation, and lateral movement; Microsoft also noted the actor has used public exploits including CVE-2023-23397. Defenders were urged to apply the October 11, 2022 patch for CVE-2022-38028, disable Print Spooler on domain controllers where possible, and use Microsoft Defender detections, EDR protections, and hunting queries to identify related activity.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Following Microsoft's public disclosure of Forest Blizzard's GooseEgg activity, CISA added CVE-2022-38028 to its Known Exploited Vulnerabilities catalog. The move formally recognized the Windows Print Spooler flaw as actively exploited in the wild.
On April 22, 2024, Microsoft Threat Intelligence disclosed that Forest Blizzard, also known as APT28/Fancy Bear and linked to GRU Unit 26165, used GooseEgg to obtain SYSTEM privileges and enable credential theft, lateral movement, persistence, and remote code execution. Microsoft also published detection guidance and mitigation recommendations, including disabling Print Spooler on domain controllers where possible.
Microsoft advised organizations to apply the security update released on October 11, 2022 for CVE-2022-38028 in the Windows Print Spooler service. The flaw was later tied to Forest Blizzard's GooseEgg privilege-escalation activity.
Microsoft said the Russian state-linked actor Forest Blizzard used a custom privilege-escalation tool called GooseEgg in post-compromise activity exploiting CVE-2022-38028. The activity dates back to at least June 2020, and possibly as early as April 2019, against government, NGO, education, and transportation targets in Ukraine, Western Europe, and North America.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritydive.com
Open sourcemicrosoft.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky detailed **Operation PowerFall**, an attack chain that used the Windows elevation-of-privilege zero-day **`CVE-2020-0986`** together with an Internet Explorer 11 remote code execution exploit to break out of the browser sandbox. The flaw was traced to the GDI Print/Print Spooler API, where attacker-controlled request data reached `gdi32full.dll`’s `GdiPrinterThunk` handler for `INDEX_DocumentEvent` and enabled an arbitrary pointer dereference. By abusing that path, attackers manipulated memory in `splwow64.exe`, turning browser compromise into code execution in a medium-integrity process. The exploit reconstructed an encoded function pointer and overwrote `fpDocumentEvent` with an encoded `LoadLibraryA` pointer, then triggered library loading to execute attacker code. Microsoft’s pointer-encoding mechanism, documented through the Windows **`EncodePointer`** API, was part of the exploitation chain because the attackers had to recover and reuse encoded values correctly. Kaspersky said the bug closely resembled the earlier in-the-wild zero-day **`CVE-2019-0880`**, describing both as variants in the same vulnerable code path, while Microsoft’s fix tightened printer command validation and handle lookup logic in `splwow64.exe` to make `OutputBuf`-based exploitation far more difficult.
Aug 14, 2026
Microsoft said the Russian military-linked threat actor **Forest Blizzard** (`APT28`/`Strontium`) has compromised vulnerable home and small-office routers since at least August 2025, changing DNS settings to route traffic through attacker-controlled resolvers. The campaign affected more than **200 organizations** and **5,000 consumer devices** across government, IT, telecommunications, and energy, turning edge devices into covert infrastructure and giving the actor passive visibility into victims’ DNS traffic. For selected high-value targets, the operation escalated into **adversary-in-the-middle** attacks in which spoofed DNS responses redirected users to systems presenting invalid TLS certificates for legitimate services, including **Microsoft Outlook on the web** and government servers. Microsoft said confirmed AiTM activity included non-Microsoft government targets in at least three African countries, while stressing that no Microsoft-owned assets or services were compromised; the company urged defenders to patch and harden routers, replace default credentials, audit DNS settings, and train users not to bypass certificate warnings.
Jul 23, 2026
**Fancy Bear (APT28)** has been attributed with high confidence to *Operation Neusploit*, a campaign targeting users in Central and Eastern Europe by weaponizing **CVE-2026-21509**, a **Microsoft RTF** parsing zero-day that enables arbitrary code execution via specially crafted RTF documents. Reported lures were written in multiple languages (including English, Romanian, Slovak, and Ukrainian) and targeted victims in **Ukraine, Slovakia, and Romania**. Microsoft issued an **out-of-band patch** for CVE-2026-21509 on **January 26, 2026**, with in-the-wild exploitation observed shortly after. Post-exploitation activity was described as a multi-stage chain that retrieves a malicious dropper DLL from attacker infrastructure and then deploys different payload paths, including **MiniDoor** (focused on Outlook email theft/exfiltration) and **PixyNetLoader**, which ultimately leads to a **Covenant Grunt** implant for command-and-control. The campaign also uses **evasion and targeting controls**, including region-restricted payload delivery (e.g., only serving malicious DLLs to requests from targeted geographies and specific `User-Agent` patterns) and persistence techniques such as **COM hijacking**, plus additional tradecraft like **steganography in PNG files** and shellcode loading to execute the final implant.
Jun 29, 2026