EuRepoC
North Korean Hacker Group Citrine Sleet Exploits Chromium Zero-Day Vulnerability on 19 August 2024 · 19.08.2024
On 19 August 2024, the North Korean hacker group Citrine Sleet exploited the Chromium zero-day vulnerability (CVE-2024-7971) to conduct remote code execution (RCE) attacks on 19 August 2024. Targets were initially directed to the Citrine Sleet-controlled exploit domain voyagorclub[.]space. Upon connection, the zero-day RCE exploit for CVE-2024-7971 was deployed. Once code execution was achieved in the sandboxed Chromium renderer process, shellcode containing a Windows sandbox escape exploit and the FudModule rootkit was downloaded and executed in memory. The sandbox escape leveraged CVE-2024-38106, allowing the main FudModule rootkit to run in memory. This rootkit uses direct kernel object manipulation (DKOM) techniques to bypass kernel security mechanisms, operating entirely from user mode while performing kernel tampering via a kernel read/write primitive. CVE-2024-7971 is a type confusion vulnerability in the V8 JavaScript and WebAssembly engine, affecting versions of Chromium prior to 128.0.6613.84. Google released a patch for this vulnerability on 21 August 2024, and users are strongly advised to update to the latest version of Chromium. This marks the third exploited V8 type confusion vulnerability patched in V8 this year, following CVE-2024-4947 and CVE-2024-5274. In response to this nation-state actor activity, Microsoft has directly notified targeted or compromised customers, providing critical information to help secure their environments.