Global security desk · updated coverage of threats, exploits & breaches
Twitter Sitemap
Circular security news icon in navy and blue tones with a shield-like mark SecNews24.com Read Latest News

PrintNightmare returns as attackers exploit Print Spooler flaw

A long-running weakness in the Windows Print Spooler service has resurfaced as a practical weapon in the hands of intruders, with security teams across multiple sectors reporting in-the-wild exploitation. Researchers tracking the activity have observed attackers chaining the flaw with credential theft tools, lateral movement utilities, and ransomware loaders to compromise corporate networks. The bug, which allows a low-privileged user to write arbitrary files and execute code as the SYSTEM account, was once dismissed as a theoretical nuisance but is now appearing in incident response cases from healthcare, education, and government environments.

Microsoft has shipped patches for the underlying class of issues over the past several years, yet many organisations continue to operate endpoints that miss critical updates or rely on legacy print server configurations. Print Spooler remains enabled by default on most Windows desktop and server installations, including domain controllers in some smaller Australian businesses, which gives attackers a reliable foothold. Threat actors have been observed using the exploit to drop secondary payloads, modify registry keys, and disable security software before pivoting to file shares and backup infrastructure.

Australia's exposure to this campaign is meaningful. The Australian Cyber Security Centre has repeatedly highlighted print services as a frequent entry vector in its Essential Eight maturity guidance, and recent ACSC partner reporting lists print server compromise among the top three initial access techniques observed in domestic intrusions during the past quarter. With hybrid work still common in Sydney, Melbourne, and Brisbane offices, employees often connect laptops to local printers while on corporate networks, broadening the surface area for attackers who target the local Print Spooler service to elevate privileges and move sideways.

The activity also dovetails with other malware families making headlines this year, including a new variant of emotet malware resurfaces after takedown, which has been delivered through compromised servers that share infrastructure with print exploit campaigns. Defenders are urged to treat Print Spooler exposure as a priority remediation item, particularly for servers exposed to the internet through remote desktop or legacy VPN appliances.

Anatomy of the Print Spooler exploit chain

The vulnerability sits within the print driver installation path of the spooler service, where Windows fails to enforce strict access controls on driver DLLs. By crafting a malicious driver package and pointing the print queue to a remote path under attacker control, the exploit causes the spooler to load the rogue DLL with SYSTEM-level privileges. From that point, the attacker can add local accounts, modify Group Policy, or inject code into highly privileged processes.

The technique is not new, but its recent application in active campaigns has been refined. Operators are now combining the spooler exploit with a network enumeration phase that uses built-in Windows tools to identify domain controllers, file servers, and backup repositories within minutes of gaining a foothold. In several documented cases, the entire attack chain from initial print spooler compromise to domain administrator access took less than four hours, which is faster than most manual detection processes used by mid-sized Australian firms.

Researchers have also noted that the same flaw can be triggered through web printing portals and cloud print connectors, extending the reach beyond traditional on-premises environments. Organisations in Australia that have migrated to hybrid print solutions with Azure AD-joined devices should review whether the local spooler is still required, and if so, whether hardened configurations have been applied.

What attackers are doing once inside

Once the spooler exploit grants SYSTEM access, the typical playbook follows a familiar rhythm. Attackers harvest credentials from memory using tools such as Mimikatz or custom equivalents, then use those credentials to move to Exchange servers, finance systems, and development environments. The objective is rarely the initial endpoint itself. The goal is data theft, ransom encryption, or long-term espionage, depending on the actor.

Several Australian victims of similar tradecraft have reported attackers disabling Windows Defender real-time protection, clearing event logs, and creating scheduled tasks that periodically beacon out to command-and-control infrastructure. In some cases, the actors leveraged legitimate remote monitoring and management tools already installed on the network, a technique that complicates detection for blue teams relying on signature-based alerts.

Healthcare providers in New South Wales and Victoria have been particularly targeted, in part because of the high value of patient records and the operational pressure that follows encryption events. Educational institutions in Queensland, where the start of the academic year traditionally triggers a wave of phishing and exploitation activity, have also appeared in the latest incident data shared by the ACSC.

Detection and hunting guidance for local teams

Detection starts with visibility into the spooler service itself. SOC teams should alert on any new printer driver installation initiated by non-administrative users, sudden creation of files inside the spooler driver cache directory, and child processes spawned by spoolsv.exe. Microsoft Defender for Identity and the broader Microsoft 365 Defender suite include hunting queries for known print spooler exploitation indicators, and these should be enabled across all tenants regardless of licence tier.

Australian organisations subject to the Security of Critical Infrastructure Act 2018 obligations, or those operating in the federal government supply chain, must also be aware that print server compromise may constitute a notifiable cybersecurity incident. The Notifiable Data Breaches scheme administered by the Office of the Australian Information Commissioner applies once personal information is likely to be accessed, and the threshold is often crossed in print-related incidents because print servers commonly hold cached copies of payroll, medical, and legal documents.

Threat hunting teams can pivot from spooler alerts to review authentication logs for unusual Kerberos ticket requests, lateral SMB sessions, and writes to Group Policy templates. Australian Signals Directorate advisories frequently include specific event IDs and Sysmon configurations that map to print spooler abuse, and these should be incorporated into the organisation's detection content library.

Hardening and patch management strategies

Microsoft's official guidance remains the foundation of any response. The latest cumulative updates for Windows 10, Windows 11, and Windows Server 2016 through 2022 include the necessary fixes for the recent print spooler exploit activity, and patching should be prioritised for domain controllers, file servers, and any system exposed to the internet. For systems that cannot be patched immediately, Microsoft recommends either disabling the Print Spooler service entirely or restricting it through Group Policy so that only signed and approved drivers can be loaded.

For many Australian small and medium businesses, the practical barrier is the printing vendor itself. Legal firms, accounting practices, and logistics companies in Adelaide and Perth often rely on legacy line-of-business applications that depend on specific print drivers, and removing the spooler can break those applications outright. In such cases, a risk-based approach is required: isolate the affected server, restrict inbound traffic to known management hosts, and add compensating controls such as application allowlisting and write-block policies on the driver cache directory.

The Essential Eight maturity model published by the ACSC provides a useful framework for prioritising these decisions. Organisations that have reached Maturity Level Two or higher on application control and patching are generally well placed to absorb the print spooler threat, while those still operating at Maturity Level One or Zero should treat any unpatched print server as a probable point of compromise and act accordingly.

Broader threat landscape and connected campaigns

The print spooler activity is one thread in a larger fabric of exploitation against Windows infrastructure. Over the same period, Australian enterprises have been targeted through vulnerable edge devices, misconfigured cloud storage buckets, and supply chain compromises affecting managed service providers. The same threat actors often rotate between these vectors, using whichever entry point offers the lowest cost of access.

The line between financially motivated cybercrime and state-aligned operations continues to blur, with several recent intrusions sharing tooling and infrastructure across both categories. Coverage of geopolitical cyber tensions between Western governments and adversarial regimes offers useful context for understanding the strategic backdrop against which these campaigns unfold, even when the immediate actor appears to be a criminal group.

This infrastructure overlap makes attribution harder for defenders and forces security operations centres to hunt across multiple campaigns at once rather than treating each intrusion as an isolated event. Collaboration between industry partners and the ACSC becomes critical in such cases, as no single organisation sees the full picture.

Strategic priorities for Australian defenders

Looking ahead, defenders should treat print spooler exposure as a long-term hygiene problem rather than a one-off patching exercise. The service is deeply embedded in Windows and will continue to attract research and exploitation for the foreseeable future, which means configuration management and detection engineering deserve sustained investment.

The Australian Signals Directorate's annual cyber threat report has consistently flagged print infrastructure as a weak link in both government and industry networks, and the current campaign reinforces that assessment. Boards and executives across Australian enterprises should ask their security leaders specific questions about print server inventory, patch latency, and segmentation, and should expect documented answers rather than general assurances.

Smaller organisations that lack in-house security teams can lean on the ACSC's free services, including the Cyber Security Assessment Tool and the ReportCyber platform, to baseline their exposure and seek guidance after an incident. Pairing those resources with managed detection and response from a reputable local provider is often the most cost-effective way for regional businesses to keep pace with evolving threats.

Practical recommendations for security teams