In a recent revelation that sounds like it’s straight out of a cyber-thriller, the infamous Lazarus Group has once again made headlines. This time, their digital sleight of hand involved turning a vulnerability in the Windows Kernel—identified as CVE-2024-21338—into a covert passage for gaining unprecedented control over targeted systems.
This particular flaw, a ticking time bomb within the Windows Kernel with a criticality score of 7.8, was discreetly maneuvered by the attackers to elevate their privileges to the highest SYSTEM level. Microsoft, in its vigilant efforts, patched this flaw in its latest Patch Tuesday updates, acknowledging the potential risks it posed.
The exploit required initial access to the system, a hurdle the Lazarus actors skillfully overcame. They crafted a specialized application, a digital trojan horse, if you will, to exploit this vulnerability, seizing control of the affected systems with the finesse of seasoned cyber puppeteers.
Although initially, there were no stirrings of this vulnerability being exploited in the wild, Microsoft’s security team, with their ears to the ground, soon detected ominous signs of its exploitation, updating their advisories to reflect the newfound threat.
The origins of CVE-2024-21338 trace back to an addition made in Windows 10, version 1703, marking the debut of a particular IOCTL handler. This piece of the puzzle was what the Lazarus Group needed to weave their nefarious plot.
Avast, a name synonymous with cybersecurity, stumbled upon this exploit being used in the wild, a testament to the ingenuity of the Lazarus Group. They didn’t just exploit the flaw; they turned it into a weapon, enhancing their notorious FudModule rootkit. This rootkit, known for its ability to blind security solutions, now boasted direct kernel object manipulation capabilities, thanks to the exploited vulnerability.
The FudModule rootkit, previously spotlighted by ESET and AhnLab, is infamous for its BYOVD (Bring Your Own Vulnerable Driver) attack strategy. However, Lazarus’s latest maneuver transcended this approach, exploiting a zero-day in an already present driver, appid.sys, integral to Windows’ AppLocker.
This strategic move by the Lazarus Group showcases their evolving tactics, which now include leveraging existing system drivers to deploy their rootkit, ensuring their malicious activities remain under the radar.
Jan Vojtěšek, a vigilant observer of cybersecurity anomalies, notes that the FudModule is a prized asset in the Lazarus arsenal, deployed with precision and caution. Its integration into their broader malware ecosystem is loose, hinting at its specialized use for high-value targets.
The Lazarus Group’s mastery over their craft is evident in their ability to elude detection mechanisms, rendering formidable security solutions like AhnLab V3 Endpoint Security, CrowdStrike Falcon, HitmanPro, and even Microsoft Defender Antivirus powerless.
This episode is not just a showcase of the Lazarus Group’s technical prowess but a stark reminder of the continuous arms race in cyberspace. Their ability to adapt and evolve their tactics underscores the persistent threat posed by such adept adversaries.
As the digital world watches, the Lazarus Group’s activities serve as a cautionary tale of the sophisticated threats looming in the cyber shadows, urging the cybersecurity community to remain ever-vigilant.
