Loading story…
Kaspersky detailed Operation PowerFall, an attack chain that used the Windows elevation-of-privilege zero-day CVE-2020-0986 together with an Internet Explorer 11 remote code execution exploit to break out of the browser sandbox. The flaw was traced to the GDI Print/Print Spooler API, where attacker-controlled request data reached gdi32full.dll’s GdiPrinterThunk handler for INDEX_DocumentEvent and enabled an arbitrary pointer dereference. By abusing that path, attackers manipulated memory in splwow64.exe, turning browser compromise into code execution in a medium-integrity process.
The exploit reconstructed an encoded function pointer and overwrote fpDocumentEvent with an encoded LoadLibraryA pointer, then triggered library loading to execute attacker code. Microsoft’s pointer-encoding mechanism, documented through the Windows EncodePointer API, was part of the exploitation chain because the attackers had to recover and reuse encoded values correctly. Kaspersky said the bug closely resembled the earlier in-the-wild zero-day CVE-2019-0880, describing both as variants in the same vulnerable code path, while Microsoft’s fix tightened printer command validation and handle lookup logic in splwow64.exe to make OutputBuf-based exploitation far more difficult.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Securelist says Operation PowerFall was disclosed in August 2020 as a targeted attack that used two zero-days: an Internet Explorer 11 remote code execution exploit and the Windows elevation-of-privilege flaw CVE-2020-0986.
Securelist states that CVE-2019-0880, a related GdiPrinterThunk vulnerability in the handler for INDEX 118, had previously been exploited in the wild as a zero-day.
Microsoft patched CVE-2020-0986 and changed printer command validation and handle lookup logic in splwow64.exe, including requiring a valid driver ID and using FindDriverForCookie to securely retrieve the handle table. The changes were intended to make OutputBuf-based exploitation significantly harder and mitigate this broader bug class.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A public GitHub repository released a pure PowerShell exploit for **CVE-2021-1675**, a Windows Print Spooler flaw widely associated with **PrintNightmare**-style abuse. The proof of concept targets **local privilege escalation**, allowing an attacker to add a new local administrator account by default or load a custom DLL payload, and was reported as tested on **Windows Server 2016** and **Windows Server 2019**. The implementation uses an embedded Base64-encoded, GZIP-compressed DLL and reflective Win32 API access techniques derived from PowerSploit/PowerUp. Microsoft’s Security Update Guide identifies **CVE-2021-1675** as a Windows Print Spooler vulnerability that was later clarified as a **remote code execution** issue, with a **CVSS 7.8** rating and high impact to confidentiality, integrity, and availability. Microsoft also noted that **PrintNightmare** is tracked separately as **CVE-2021-34527**, even though the vulnerabilities are similar, underscoring confusion around spooler-related exploitation as public exploit code circulated alongside an official patch.
Aug 15, 2026
Microsoft disclosed that the Russian state-linked threat actor **Forest Blizzard**—also tracked as **APT28**, **STRONTIUM**, **Fancy Bear**, **Sednit**, and **Sofacy**—used a custom post-compromise tool called **GooseEgg** to escalate privileges on compromised Windows systems. The activity targeted government, NGO, education, and transportation organizations in Ukraine, Western Europe, and North America, and has been observed since at least June 2020, with possible activity dating back to April 2019. Microsoft linked the group to **GRU Unit 26165**, consistent with prior US and UK government attributions. According to Microsoft, GooseEgg exploited **`CVE-2022-38028`** in the Windows **Print Spooler** by modifying a JavaScript constraints file and abusing a rogue protocol handler so a malicious DLL could run as **SYSTEM** through the Print Spooler process. The tool was used as a launcher for DLLs or executables, enabling credential theft, remote code execution, persistence, backdoor installation, and lateral movement; Microsoft also noted the actor has used public exploits including **`CVE-2023-23397`**. Defenders were urged to apply the **October 11, 2022** patch for `CVE-2022-38028`, disable Print Spooler on domain controllers where possible, and use Microsoft Defender detections, EDR protections, and hunting queries to identify related activity.
Jun 29, 2026
Microsoft patched **CVE-2019-0859**, a `win32k.sys` elevation-of-privilege flaw that Kaspersky said was exploited in the wild to give attackers higher privileges on affected Windows systems. The bug was a use-after-free condition in the `CreateWindowEx` path tied to `WM_NCCREATE` handling and manipulation of a window Function ID, allowing a freed window object to be reused for privilege escalation. Microsoft tracked the issue as a **Win32k Elevation of Privilege Vulnerability** in its Security Update Guide. Kaspersky reported attacks against 64-bit Windows systems ranging from Windows 7 to older Windows 10 builds, with exploitation observed in March 2019. According to the report, the exploit used `HMValidateHandle` to help bypass ASLR, then launched PowerShell to fetch additional payload stages; the final payload unpacked shellcode and opened an HTTP reverse shell, giving the attacker full control of the compromised machine.
Aug 15, 2026