Russia's Fancy Bear Pummels Windows Print Spooler Bug

**Executive Summary:** Microsoft Threat Intelligence attributes use of a custom GooseEgg tool to Fancy Bear (APT28), which exploits CVE-2022-38028 in the Windows Print Spooler to obtain SYSTEM privileges, launch embedded DLLs (e.g., files with "wayzgoose"), steal credentials, and enable follow-on actions such as remote code execution and lateral movement against government, NGO, education, and transportation targets across Ukraine, Western Europe, and North America; Microsoft recommends applying the CVE-2022-38028 patch, using Defender detections, and disabling Print Spooler on domain controllers where feasible.