Well it's begun today - threat actors are now actively exploiting Microsoft Exchange server with the ProxyShell vulnerability to drop webshells and backdoors.
As part of today's Patch Tuesday updates, Microsoft has released an update to fix the recent PrintNightmare elevation of privileges vulnerabilities released by @gentilkiwi and others. bleepingcomputer.com/news/microsoft…
To exploit the bug, a print server would be created with a specially crafted printer driver.
A low-privileged users could connect to the print server, and using Point and Print, the driver would be installed with a DLL that opens a SYSTEM-level console. bleepingcomputer.com/news/microsoft…
The Hotcobalt bugs can be exploited by registering fake beacons which help crash Cobalt Strike C2 servers, blocking C2 comms and new beacon deployments.
Law enforcement and researchers can also use Hotcobalt to take down malicious infrastructure.
Last month, @topotam77 discovered a new unauthenticated vector in the Microsoft Encrypting File System Remote Protocol (EFSRPC) API to perform Windows NTLM relay attacks. bleepingcomputer.com/news/microsoft…
It was quickly illustrated how easily these attacks could be conducted to take over a Windows domain.