Rootkit Malware attack using BYOVD · October
Annex 76: List of DPRK cyberthreat actors' malicious activities in 2022 monitored by the Panel (table row 28 of 37). RGB Unit: Lazarus Group; Case Name: Rootkit Malware attack using BYOVD; SPH √; VAS: (blank); Publicized Month: October. (Note: RGB Reconnaissance General Bureau, SPH Significant Phishing, KAC knowledge acquisition and espionage, VAS virtual asset seizures.)
Windows rootkit exploiting a Dell firmware driver (CVE-2021-21551), BLINDINGCAN backdoor; target included an aerospace company employee
Para 141: “The Lazarus Group has been observed by a cybersecurity firm deploying a Windows rootkit ... by taking advantage of an exploit in a Dell firmware driver. A target of the campaign included an employee of an aerospace company. According to the firm, the campaign abused the “CVE-2021-21551” vulnerability affecting Dell DBUtil drivers by using a HTTP(S) backdoor known as “BLINDINGCAN”. ... The firm further assessed that the Lazarus Group’s primary focus is on specific types of industries – aerospace and defence, and conventional finance and cryptocurrencies ...” (footnote 115: www.welivesecurity.com/2022/09/30/amazon-themed-campaigns-lazarus)