North Korean State-Sponsored Hacker Group Lazarus Exploited Windows Zero-Day Vulnerability in Admin-to-Kernel Operation going back to at least August 2023

EuRepoC

On 28 February 2024, the Czech cybersecurity software company Avast announced a major cybersecurity incident involving Lazarus Group. The reporting revealed that Lazarus executed an admin-to-kernel exploit that took advantage of a zero-day vulnerability in the appid.sys driver of the Windows AppLocker (CVE-2024-21338) to gain kernel-level access. AppLocker is a Windows functionality for whitelisting applications. This complex intrusion technique targeted a critical component of Windows security responsible for application policy enforcement. Exploitation of this zero-day vulnerability in the central driver of the Windows feature allowed Lazarus to gain kernel privileges and execute arbitrary code. This extended access positioned the group to disable security software and manipulate kernel objects directly. Unlike traditional Bring Your Own Vulnerable Driver (BYOVD) techniques that rely on loading third-party software, with appid.sys, Lazarus targeted a driver preinstalled on the target systems. This approach combines BYOVD techniques with living-off-the-land tactics, adding to the difficulties for detection. The threshold for such operations is high, due to the smaller number of drivers that are built into operating systems and their higher code quality. Avast developed a proof of concept for the exploitation of the vulnerability, which it submitted to Microsoft in August 2023. Microsoft provided a fix for the zero-day vulnerability on 13 February 2024, as part of its monthly update cycle. As a result of this large-scale remediation of the zero-day enabling this rootkit, Avast researchers noted that Lazarus likely lost one of its most complex tools and would possibly have to revert to less stealthy BYOVD techniques. Avast did not disclose details about the victim of the exploitation or how successful the operation was before its discovery. On 18 April 2024, Czech IT security company Avast reported that the state-sponsored North Korean hacker group Lazarus hacked certain individuals with technical backgrounds in Asia in the summer of 2023. According to the report, Lazarus lured these specific individuals with fake job offers, likely through standard social media, in which Lazarus sent malicious files to its targets, allegedly as part of the job interview. Clicking on the malicious files caused the three loaders, RollSling, RollFling and RollMid, to be triggered, which in turn triggered the Kaolin Remote Access Trojan (RAT), which in turn triggered the FudModule rootkit to gain access to the computer in question. As part of the cyber incident, Lazarus aimed to blind security products by exploiting the vulnerability in the Windows Driver (CVE-2024-21338).