Lazarus APT exploited zero-day in Windows driver to gain kernel privileges

North Korea-linked Lazarus APT exploited a zero-day flaw in the Windows AppLocker driver (appid.sys) to gain kernel-level access to target systems. Avast researchers observed North Korea-linked Lazarus APT group using an admin-to-kernel exploit for a zero-day vulnerability in the appid.sys AppLocker driver.  The zero-day, tracked as CVE-2024-21338 has been addressed by Microsoft in the February […]

access admin applocker apt apt group avast breaking news cve cve-2024-21338 driver exploit exploited flaw hacking information security news it information security kernel kernel privileges korea lazarus lazarus apt lazarus apt group malware north north korea pierluigi paganini privileges researchers rootkit systems target vulnerability windows windows driver zero-day zero-day flaw zero-day vulnerability