The infamous North Korean Lazarus hacking group exploited a zero-day flaw within the Home windows AFD.sys driver to raise privileges and set up the FUDModule rootkit on focused methods.
Microsoft mounted the flaw, tracked as CVE-2024-38193 throughout its August 2024 Patch Tuesday, together with seven different zero-day vulnerabilities.
CVE-2024-38193 is a Deliver Your Personal Weak Driver (BYOVD) vulnerability within the Home windows Ancillary Operate Driver for WinSock (AFD.sys), which acts as an entry level into the Home windows Kernel for the Winsock protocol.
The flaw was found by Gen Digital researchers, who say that the Lazarus hacking group exploited the AFD.sys flaw as a zero-day to put in the FUDModule rootkit, used to evade detection by turning off Home windows monitoring options.
“In early June, Luigino Camastra and Milanek discovered that the Lazarus group was exploiting a hidden security flaw in a crucial part of Windows called the AFD.sys driver,” warned Gen Digital.
“This flaw allowed them to gain unauthorized access to sensitive system areas. We also discovered that they used a special type of malware called Fudmodule to hide their activities from security software.”
A Deliver Your Personal Weak Driver assault is when attackers set up drivers with recognized vulnerabilities on focused machines, that are then exploited to realize kernel-level privileges. Risk actors usually abuse third-party drivers, similar to antivirus or {hardware} drivers, which require excessive privileges to work together with the kernel.
What makes this explicit vulnerability extra harmful is that the vulnerability was in AFD.sys, a driver that’s put in by default on all Home windows gadgets. This allowed the risk actors to conduct this sort of assault with out having to put in an older, susceptible driver which may be blocked by Home windows and simply detected.
The Lazarus group has beforehand abused the Home windows appid.sys and Dell dbutil_2_3.sys kernel drivers in BYOVD assaults to put in FUDModule.
The Lazarus hacking group
Whereas Gen Digital didn’t share particulars about who was focused within the assault and when the assaults occurred, Lazarus is thought to focus on monetary and cryptocurrency corporations in million-dollar cyberheists used to fund the North Korean authorities’s weapons and cyber packages.
The group gained notoriety after the 2014 Sony Footage blackmail hack and the 2017 international WannaCry ransomware marketing campaign that encrypted companies worldwide.
In April 2022, the US authorities linked the Lazarus group to a cyberattack on Axie Infinity that allowed the risk actors to steal over $617 million price of cryptocurrency.
The US authorities gives a reward of as much as $5 million for recommendations on the DPRK hackers’ malicious exercise to assist establish or find them.
