Russia's APT28 Exploited Windows Print Spooler Flaw to Deploy 'GooseEgg' Malware

**Summary:** Microsoft reports that Russia-linked APT28 (aka Forest Blizzard/Fancy Bear) weaponized a Windows Print Spooler privilege-escalation vulnerability (CVE-2022-38028) to deploy a previously undocumented post-compromise tool named GooseEgg—used to spawn elevated processes, deliver DLLs/executables, and enable credential theft and lateral movement across targeted Ukrainian, Western European, and North American government, NGO, education, and transportation networks; the report also highlights IBM X-Force findings on Gamaredon (Hive0051) phishing campaigns delivering multiple GammaLoad malware variants.