North Korean threat actors known as the Lazarus Group exploited a flaw in the Windows AppLocker driver (appid.sys) as a zero-day to gain kernel-level access and turn off security tools, allowing them to bypass noisy BYOVD (Bring Your Own Vulnerable Driver) techniques. This activity was detected by Avast analysts, who promptly reported it to Microsoft, leading to a fix for the flaw, now tracked as CVE-2024-21338, as part of the February 2024 Patch Tuesday. However, Microsoft has not marked the flaw as being exploited as a zero-day. Avast reports that Lazarus exploited CVE-2024-21338 to create a read/write kernel primitive in an updated version of its FudModule rootkit, which ESET first documented in late 2022. Previously, the rootkit abused a Dell driver for BYOVD attacks. The new version of FudModule features significant enhancements in stealth and functionality, including new and updated techniques for evading detection and turning off security protections like Microsoft Defender and CrowdStrike Falcon. Moreover, by retrieving most of the attack chain, Avast discovered a previously undocumented remote access trojan (RAT) used by Lazarus, which the security firm promised to share more details about at BlackHat Asia in April. The malware exploited a vulnerability in Microsoft's 'appid.sys' driver, a Windows AppLocker component that provides application whitelisting capabilities. Lazarus exploits it by manipulating the Input and Output Control (IOCTL) dispatcher in the appid.s...
Lazarus hackers exploited Windows zero-day to gain Kernel privileges
BleepingComputer
·Bill Toulas
·Published Feb 28, 2024
·Updated
Affected Software
6 affected components
Microsoft Windows AppLocker driver
Microsoft appid.sys
Lazarus Group FudModule rootkit
AhnLab V3 Endpoint Security
Microsoft Windows Defender
CrowdStrike Falcon
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses how the Lazarus Group exploited a Windows zero-day vulnerability to gain kernel privileges.
2
What security implications are discussed in this article?
The article highlights the risk of zero-day vulnerabilities allowing attackers to disable security tools and bypass defenses.
3
What products or software are affected by this exploit?
The affected products include Microsoft Windows AppLocker driver, appid.sys, AhnLab V3 Endpoint Security, Windows Defender, and CrowdStrike Falcon.
4
Who are the threat actors involved in this exploit?
The threat actors involved in this exploit are known as the Lazarus Group, a North Korean hacking organization.
5
How did the Lazarus Group utilize the zero-day flaw?
The Lazarus Group used the zero-day flaw in the Windows AppLocker driver to turn off security tools and gain elevated privileges.