Lazarus hackers return and hijack a Windows security flaw
North Korean hackers seen disabling antivirus programs
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
The infamous Lazarus Group is exploiting a zero-day vulnerability to disable antivirus programs on targeted Windows endpoints, new research has claimed.
Cybersecurity experts from Avast said they observed a new campaign from the North Korean state-sponsored hackers, which now leverages a flaw in the Windows AppLocker driver. This flaw, tracked as CVE-2024-21338, allowed them to gain kernel-level access to the device. They used it to disable any antivirus programs installed on the device, opening the doors for more disruptivemalware.
The flaw was found in the appid.sys driver, a component of Windows AppLocker that handles whitelisting.
Who are Lazarus Group?
To exploit the zero-day, Lazarus used a new version of FudModule, its proprietary rootkit which was first spotted in late 2022. In previous attacks, the rootkit abused aDelldriver, in what’s known as Bring Your Own Vulnerable Driver (BYOVD) attack. Now, FudModule is stealthier and more functional, offering more ways to avoid being detected and turn off endpoint protection solutions.
Apparently, the group used it to disable products such as AhnLab V3 Endpoint Security, Windows Defender, CrowdStrike Falcon, and the HitmanPro anti-malware solution.
Avast notifiedMicrosoftof its findings, which released a fix for the flaw as part of its February 2024 Patch Tuesday cumulative update. This is also the only way to remain secure, so applying the patch without hesitation is advised.
Lazarus Group is one of the world’s most prominent, and infamous, cybercriminal organizations. Researchers believe it is under the direct control of the North Korean government, and it often uses its skills for cyber-espionage, but as well as money heists.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The group is known for its “fake job” attacks, where they promote fake jobs on social media sites and engage in multiple rounds of negotiations with potential candidates, usually software developers. One such attack against a cryptocurrency business resulted in the theft of more than half a billion dollars in various crypto tokens.
ViaBleepingComputer
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This dangerous new malware is hitting Windows devices by hiding in games
Windows PCs targeted by new malware hitting a vulnerable driver
Steps to take when your phone number is publicly listed online
