Executive Summary
Avast Threat Labs discovered a sophisticated campaign by the Lazarus Group utilizing a previously unknown zero-day vulnerability in the Windows AppLocker driver (appid.sys), tracked as CVE-2024-21338. This vulnerability allowed the threat actor to cross the admin-to-kernel boundary without the noisy requirement of 'Bring Your Own Vulnerable Driver' (BYOVD) techniques. By exploiting the AppLocker IOCTL dispatcher, Lazarus obtained a kernel read/write primitive, enabling the deployment of an updated variant of the FudModule rootkit.
The updated FudModule rootkit is a data-only threat that manipulates kernel objects (DKOM) to disable security mechanisms including Registry callbacks, Object callbacks, and Windows Filtering Platform (WFP) callouts. Notably, it introduces a novel handle table entry manipulation technique to disable Protected Process Light (PPL) processes associated with major EDR providers. This activity highlights Lazarus's advanced research capabilities and their focus on maintaining stealth through the use of built-in Windows drivers as exploit targets.
The impact is critical for organizations relying on standard EDR protections, as the rootkit specifically targets and blinds these tools. Microsoft patched CVE-2024-21338 in February 2024, making immediate patching the primary defense against this specific exploit chain.