Microsoft: APT28 hackers exploit Windows flaw reported by NSA

Microsoft reports that Russian APT28 (Forest Blizzard) has used a custom post-compromise tool called GooseEgg to exploit the Windows Print Spooler vulnerability CVE-2022-38028 since at least June 2020, enabling SYSTEM-level execution, credential theft, persistence (scheduled tasks and batch scripts), and deployment of embedded DLL launchers to install backdoors and move laterally across government, NGO, education, and transportation networks.