Joint CyberSecurity Advisory Alert on PrintNightmare Vulnerability and Default MFA Protocols Exploited by Russian State-Sponsored Cyber Actors (AA22-074A)

FortiGuard Labs summarizes a CISA/FBI advisory reporting that Russian state-sponsored actors compromised an NGO by brute-forcing credentials, re-enrolling a dormant Duo MFA device, exploiting PrintNightmare (CVE-2021-34527) to escalate privileges, and altering the domain controller hosts file to disable MFA; the actors then moved laterally to exfiltrate data from cloud storage and email accounts and the advisory includes mitigations and FortiGuard coverage.