Lazarus Group Exploited Windows Zero-Day

The North Korean threat actor Lazarus Group exploited a previously unknown vulnerability in the Windows operating system to help perform cyberattacks. This exploit, discovered by researchers at cybersecurity firm Avast, allowed the hackers to gain kernel-level access.

According to Bleeping Computer, Microsoft did release a patch addressing the issue (tracked as CVE-2024-21338), but did not mark it as being actively exploited. This oversight could have left users at risk by making the security fix seem less essential.

The exploit targets the Windows AppLocker driver “appid.sys”, and allows the attackers to create a read/write kernel primitive in their updated FudModule rootkit, previously documented by ESET. By achieving this, the threat actor can bypass traditional security measures and use kernel-level privileges — and as it’s a built-in Windows driver that’s being misused, it’s particularly hard to detect and stop.

The Lazarus Group often deploys the FudModule rootkit to evade detection and disable security tools like Windows Defender and CrowdStrike Falcon. AhnLab V3, Endpoint Security, and HitmanPro are some of the other security products targeted by this malware.

In a worrying development, the FudModule rootkit was also observed exhibiting new stealth capabilities, including the suspension of certain Protected Process Light (PPL) processes and enhancements in the tampering of Driver Signature Enforcement and Secure Boot.

Avast's findings also uncovered a previously undocumented remote access trojan (RAT) used by Lazarus. The researchers promised further details regarding it at the upcoming Black Hat Asia conference.

Cybersecurity communities are encouraged to review the YARA rules provided by Avast, which can help detect activities associated with the latest version of the FudModule rootkit. However, for now, the most effective solution is to install the Windows February 2024 Patch Tuesday updates as soon as possible.

Microsoft hasn’t had much luck lately, with this cybersecurity incident closely following the recent discovery of a trivial Outlook exploit, which existed in the wild for years.