Multiple organizations · 28/02/2024
Researchers from Avast reveal that North Korean threat actors known as the Lazarus Group exploited CVE-2024-21338, a flaw in the Windows AppLocker driver (appid.sys) as a zero-day to gain kernel-level access and turn off security tools, allowing them to bypass noisy BYOVD (Bring Your Own Vulnerable Driver) techniques. [Date Occurred: -; Date Discovered: -]
Microsoft Windows Security Update Advisory (CVE-2024-21338) · 2024-02-28
excerpt: Overview On February 13th, 2024, Microsoft announced a Windows Kernel Elevation of Privilege Vulnerability CVE-2024-21338 patch. The vulnerability occurs at certain IOCTL of “appid.sys” known as AppLocker‘s driver, one of the Windows feature. The threat actor can read and write on a random kernel memory by exploiting the vulnerability, and can either disable security products […] | attribution sentence: AVAST reported that the Lazarus threat group has recently used CVE-2024-21338 vulnerability to disable security products.
Microsoft Windows의 보안 업데이트 권고 (CVE-2024-21338) · 2024-02-28
excerpt: 개요 2024년 2월 13일 Microsoft에서는 윈도우 커널 권한 상승 취약성(Windows Kernel Elevation of Privilege Vulnerability) CVE-2024-21338 패치를 발표하였다. 해당 취약성은 윈도우 기능인 AppLocker의 드라이버로 알려진 “appid.sys”의 특정 IOCTL에서 발생한다. 공격자는 취약성을 악용하여 임의의 커널 메모리 영역에 읽기/쓰기를 수행할 수 있으며 공격자의 의도에 따라 보안 제품을 무력화하거나 시스템 권한 획득이 가능하다. 최근 Lazarus 공격 그룹이 보안 […] | attribution sentence: 최근 Lazarus 공격 그룹이 보안 제품을 무력화하기 위해 CVE-2024-21338을 사용했다는 분석 내용이 AVAST 로부터 보고되었다.
2月修正のWindows脆弱性、北朝鮮グループがゼロデイ攻撃に悪用 · 2024-03-05
attribution sentence(s): 2月修正のWindows脆弱性、北朝鮮グループがゼロデイ攻撃に悪用 | 2月の月例セキュリティ更新でWindowsカーネルの脆弱性「CVE-2024-21338」が修正された。当初マイクロソフトは悪用は確認されていないとしていたが、北朝鮮の攻撃グループ「Lazarus」がゼロデイ攻撃に悪用していたことがわかった。 | Avastは、北朝鮮が関与するとされる攻撃グループ「Lazarus」が悪用していたと指摘。同グループが展開するルートキット「FudModule」のあらたなバージョンに悪用コードが実装されていた。
Lazarus and the FudModule Rootkit: Beyond BYOVD with an Admin-to-Kernel Zero-Day · 2024-02-28T17:44:19Z
The exploitation activity was orchestrated by the notorious Lazarus Group, with the end goal of establishing a kernel read/write primitive.
Lazarus and the FudModule Rootkit: Beyond BYOVD with an Admin-to-Kernel Zero-Day (CVE-2024-21338) · 2024-02-28T17:44:19Z
The exploitation activity was orchestrated by the notorious Lazarus Group, with the end goal of establishing a kernel read/write primitive.