Lazarus hackers exploited Windows zero-day to gain Kernel privileges

North Korean threat actors known as the Lazarus Group exploited a flaw in the Windows AppLocker driver (appid.sys) as a zero-day to gain kernel-level access and turn off security tools, allowing them to bypass noisy BYOVD (Bring Your Own Vulnerable Driver) techniques. [...]

access applocker bring your own vulnerable driver byovd bypass driver exploited flaw hackers kernel kernel privileges lazarus lazarus group microsoft noisy north north korean own privileges security security tools techniques threat threat actors tools turn vulnerable vulnerable driver windows zero-day