The North Korean threat actor known as Lazarus has exploited a critical vulnerability in the Windows AppLocker driver named “appid.sys”. The attack granted the attackers kernel-level access and the ability to disable security tools, employing a zero-day exploit to bypass traditional Bring Your Own Vulnerable Driver (BYOVD) methods. This flaw, tracked as CVE-2024-21338, was discovered by Avast analysts and subsequently patched by Microsoft during the February 2024 Patch Tuesday, though not officially classified as a zero-day exploit. Lazarus exploited this vulnerability to enhance the capabilities of their FudModule rootkit, which now includes advanced evasion and disabling functionalities for security software like Microsoft Defender and CrowdStrike Falcon. Avast’s investigation also uncovered a new, undocumented remote access trojan (RAT) used in these attacks, with further details expected to be shared at BlackHat Asia in April. The exploit involves manipulating the IOCTL (an abbreviation for input/output control) dispatcher in the “appid.sys” driver, allowing for arbitrary code execution and enabling stealthier, more persistent attacks by the Lazarus Group. Along with the patches, Microsoft has provided YARA rules for detecting the latest FudModule rootkit activity. CTIX analysts urge administrators to apply Microsoft’s recent patches immediately to prevent future exploitation.