Lazarus Hackers Exploited Windows Kernel Flaw as Zero-Day in Recent Attacks

The infamous Lazarus Group actors exploited a not too long ago patched privilege escalation flaw in the Windows Kernel as a zero-day to acquire kernel-degree accessibility and disable security software program on compromised hosts.

The vulnerability in query is CVE-2024-21338 (CVSS score: 7.8), which can permit an attacker to attain Process privileges. It was solved by Microsoft previously this thirty day period as element of Patch Tuesday updates.

“To exploit this vulnerability, an attacker would to start with have to log on to the program,” Microsoft stated. “An attacker could then run a specifically crafted application that could exploit the vulnerability and consider command of an impacted procedure.”

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

Even though there were being no indications of lively exploitation of CVE-2024-21338 at the time of the release of the updates, Redmond on Wednesday revised its “Exploitability evaluation” for the flaw to “Exploitation Detected.”

Cybersecurity seller Avast, which learned an in-the-wild admin-to-kernel exploit for the bug, mentioned the kernel study/write primitive achieved by weaponizing the flaw allowed the Lazarus Group to “accomplish immediate kernel object manipulation in an up to date edition of their information-only FudModule rootkit.”

The FudModule rootkit was very first documented by ESET and AhnLab in October 2022 as able of disabling the checking of all security options on contaminated hosts by indicates of what’s known as a Deliver Your Have Susceptible Driver (BYOVD) attack, wherein an attacker a driver susceptible to a regarded or zero-working day flaw to escalate privileges.

What makes the most current attack significant is that it goes “over and above BYOVD by exploiting a zero-working day in a driver that’s recognized to be now put in on the goal equipment.” That prone driver is appid.sys, which is important to the performing of a Windows element known as AppLocker that’s accountable for application manage.

The authentic-world exploit devised by the Lazarus Group entails using CVE-2024-21338 in the appid.sys driver to execute arbitrary code in a way that bypasses all security checks and operates the FudModule rootkit.

“FudModule is only loosely built-in into the rest of Lazarus’ malware ecosystem and that Lazarus is quite watchful about utilizing the rootkit, only deploying it on demand from customers below the appropriate instances,” security researcher Jan Vojtěšek mentioned, describing the malware as less than active progress.

Other than using actions to sidestep detection by disabling procedure loggers, FudModule is engineered to switch off certain security program these kinds of as AhnLab V3 Endpoint Security, CrowdStrike Falcon, HitmanPro, and Microsoft Defender Antivirus (formerly Windows Defender).

The growth marks a new level of technological sophistication affiliated with North Korean hacking teams, continually iterating its arsenal for enhanced stealth and operation. It also illustrates the elaborate techniques used to hinder detection and make their tracking a great deal more durable.

The adversarial collective’s cross-system focus is also exemplified by the simple fact that it has been noticed using bogus calendar assembly invite one-way links to stealthily put in malware on Apple macOS devices, a campaign that was previously documented by SlowMist in December 2023.

“Lazarus Team continues to be amongst the most prolific and long-standing state-of-the-art persistent menace actors,” Vojtěšek stated. “The FudModule rootkit serves as the newest illustration, representing 1 of the most sophisticated tools Lazarus holds in their arsenal.”

Discovered this posting attention-grabbing? Abide by us on Twitter  and LinkedIn to go through far more exclusive information we put up.