The infamous North Korean Lazarus hacking group exploited a zero-day flaw within the Home windows AFD.sys driver to raise privileges and set up the FUDModule rootkit on focused programs.
Microsoft fastened the flaw, tracked as CVE-2024-38193 throughout its August 2024 Patch Tuesday, together with seven different zero-day vulnerabilities.
CVE-2024-38193 is a Convey Your Personal Weak Driver (BYOVD) vulnerability within the Home windows Ancillary Operate Driver for WinSock (AFD.sys), which acts as an entry level into the Home windows Kernel for the Winsock protocol.
The flaw was found by Gen Digital researchers, who say that the Lazarus hacking group exploited the AFD.sys flaw as a zero-day to put in the FUDModule rootkit, used to evade detection by turning off Home windows monitoring options.
“In early June, Luigino Camastra and Milanek found that the Lazarus group was exploiting a hidden security flaw in a vital a part of Home windows referred to as the AFD.sys driver,” warned Gen Digital.
“This flaw allowed them to realize unauthorized entry to delicate system areas. We additionally found that they used a particular kind of malware referred to as Fudmodule to cover their actions from security software program.”
A Convey Your Personal Weak Driver assault is when attackers set up drivers with recognized vulnerabilities on focused machines, that are then exploited to realize kernel-level privileges. Risk actors typically abuse third-party drivers, corresponding to antivirus or {hardware} drivers, which require excessive privileges to work together with the kernel.
What makes this explicit vulnerability extra harmful is that the vulnerability was in AFD.sys, a driver that’s put in by default on all Home windows gadgets. This allowed the risk actors to conduct this sort of assault with out having to put in an older, weak driver that could be blocked by Home windows and simply detected.
The Lazarus group has beforehand abused the Home windows appid.sys and Dell dbutil_2_3.sys kernel drivers in BYOVD assaults to put in FUDModule.
The Lazarus hacking group
Whereas Gen Digital didn’t share particulars about who was focused within the assault and when the assaults occurred, Lazarus is thought to focus on monetary and cryptocurrency companies in million-dollar cyberheists used to fund the North Korean authorities’s weapons and cyber applications.
The group gained notoriety after the 2014 Sony Footage blackmail hack and the 2017 world WannaCry ransomware marketing campaign that encrypted companies worldwide.
In April 2022, the US authorities linked the Lazarus group to a cyberattack on Axie Infinity that allowed the risk actors to steal over $617 million price of cryptocurrency.
The US authorities gives a reward of as much as $5 million for recommendations on the DPRK hackers’ malicious exercise to assist establish or find them.
