Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Protect assets from ransomware, trojans, rootkits and more.
Intelligence and visibility across AWS, O365, DevOps and more.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
Proof-of-Concept (PoC) exploit code for the critical Windows vulnerability CVE-2021-1675 has been identified in the wild. CVE-2021-1675, also known as PrintNightmare, was disclosed and patched by Microsoft on June 8th, in the June 2021 Patch Tuesday security release. The vulnerability is classified as Remote Code Execution (RCE). Exploitation could allow a threat actor to take full control of vulnerable systems. Currently there is no indication of exploitation of the PrintNightmare vulnerability in the wild.
The public release of PoC code significantly reduces the barriers for exploitation. Due to this release, attacks in the wild are expected in the immediate future. Organizations are strongly recommended to apply the relevant security patches.
Updated July 1st, 2021
The PoC exploit code was originally planned to be released by a security firm at BlackHat USA but was released in error on June 29th. The code was publicly available for multiple hours before being taken down. The security company plans to officially release the code and additional details at BlackHat USA in July 2021. eSentire has confirmed that despite the code takedown, it was copied and remains publicly available.
CVE-2021-1675 (CVSS: 7.8) is classified as a Windows Print Spooler Remote Code Execution vulnerability. A threat actor with local access to a vulnerable asset may exploit this vulnerability for code execution, lateral movement, and privilege escalation. In an attack scenario threat actors may exploit the vulnerability via previous access, remotely via SSH (using credentials), or through a malicious document (with user interaction).