Hackers Exploiting Dell Driver Vulnerability to Deploy Rootkit on Targeted Computers

The North Korea-backed Lazarus Team has been observed deploying a Windows rootkit by taking gain of an exploit in a Dell firmware driver, highlighting new tactics adopted by the state-sponsored adversary.

The Convey Your Own Susceptible Driver (BYOVD) attack, which took location in the autumn of 2021, is another variant of the danger actor’s espionage-oriented action called Procedure In(ter)ception that is directed towards aerospace and defense industries.

“The campaign started out with spear-phishing emails containing malicious Amazon-themed files and targeted an personnel of an aerospace enterprise in the Netherlands, and a political journalist in Belgium,” ESET researcher Peter Kálnai explained.

Attack chains unfolded on the opening of the lure documents, main to the distribution of malicious droppers that were being trojanized versions of open resource assignments, corroborating recent reports from Google’s Mandiant and Microsoft.

ESET claimed it uncovered proof of Lazarus dropping weaponized variations of FingerText and sslSniffer, a ingredient of the wolfSSL library, in addition to HTTPs-primarily based downloaders and uploaders.

The intrusions also paved the way for the group’s backdoor of alternative dubbed BLINDINGCAN – also known as AIRDRY and ZetaNile – which an operator can use to control and check out compromised systems.

But what is actually noteworthy about the 2021 attacks was a rootkit module that exploited a Dell driver flaw to obtain the capability to go through and publish kernel memory. The issue, tracked as CVE-2021-21551, relates to a set of critical privilege escalation vulnerabilities in dbutil_2_3.sys.

“[This] signifies the initial recorded abuse of the CVE‑2021‑21551 vulnerability,” Kálnai pointed out. “This device, in mix with the vulnerability, disables the monitoring of all security alternatives on compromised equipment.”

Named FudModule, the earlier undocumented malware achieves its ambitions by means of multiple techniques “either not regarded prior to or familiar only to specialised security researchers and (anti-)cheat builders,” according to ESET.

“The attackers then utilised their kernel memory publish accessibility to disable 7 mechanisms the Windows working procedure gives to watch its actions, like registry, file procedure, course of action generation, party tracing, and so on., basically blinding security answers in a really generic and strong way,” Kálnai reported. “Definitely this expected deep research, advancement, and screening skills.”

This is not the first time the danger actor has resorted to using a susceptible driver to mount its rootkit attacks. Just previous thirty day period, AhnLab’s ASEC in-depth the exploitation of a authentic driver recognised as “ene.sys” to disarm security computer software installed in the equipment.

The results are a demonstration of the Lazarus Group’s tenacity and skill to innovate and shift its practices as necessary more than the years regardless of powerful scrutiny of the collective’s functions from both legislation enforcement and the broader study community.

“The diversity, variety, and eccentricity in implementation of Lazarus strategies determine this group, as nicely as that it performs all three pillars of cybercriminal activities: cyber espionage, cyber sabotage, and pursuit of financial obtain,” the business mentioned.

Discovered this short article exciting? Observe THN on Facebook, Twitter  and LinkedIn to study a lot more exceptional articles we article.

Some pieces of this write-up are sourced from:
thehackernews.com