Lazarus APT group exploited a zero-day vulerability in early June 2024 against unspecified targets · 01.06.2024
Gen Threat Labs uncovered and reported a zero-day vulnerability in the AFD.sys driver (CVE-2024-38193) to gain unauthorized access to unspecified sensitive system areas in early June 2024. The vulnerability was actively exploited by the North-Korea-linked Lazarus APT group and has now been fixed by Microsoft.
Multiple organizations · 16/08/2024
Microsoft addresses a zero-day vulnerability, tracked as CVE-2024-38193, which has been exploited by the North Korea-linked Lazarus APT group. [Date Occurred: Since at least early June 2024; Date Discovered: Early June 2024]
Evolution of Lazarus ‘FudModule - no longer (stand)alone’ (CVE-2024-38193 Winsock zero-day) · 2024-09-19T12:00:00Z
In early June, we discovered a sample that was exploiting a new zero-day vulnerability within Winsock driver ( CVE-2024-38193 ) to achieve local privilege escalation to deploy a new version of FudModule rootkit. We determined that the sample was part of a Lazarus Group operation that was targeting potentially sensitive industries such as aerospace and cryptocurrency engineering to gain access to their corporate networks.