A recently patched zero-day vulnerability in Google Chrome (CVE-2024-7971) has been exploited by North Korean-linked threat actors in a campaign targeting the cryptocurrency industry. The threat actor, identified as Citrine Sleet (also known as AppleJeus, Labyrinth Chollima, and UNC4736), is linked to North Korea’s Reconnaissance General Bureau and is considered a subgroup within the notorious Lazarus Group. This campaign, detected on August 19, 2024, involved sophisticated social engineering techniques, including the creation of fake websites mimicking legitimate cryptocurrency trading platforms. These sites lured victims into downloading malicious crypto wallets or trading apps, which facilitated the theft of digital assets. The zero-day exploit in question, CVE-2024-7971, is a high-severity type confusion vulnerability in the V8 JavaScript engine used by Chromium-based browsers. The exploitation of this flaw enabled remote code execution (RCE) within the sandboxed Chromium renderer process. Victims were typically directed to a malicious website (voyagorclub[.]space) where the exploit was triggered. Upon successful exploitation, the attackers deployed shellcode containing a Windows sandbox escape exploit (CVE-2024-38106) and the FudModule rootkit. This rootkit allows attackers to gain SYSTEM privileges, perform direct kernel object manipulation, and maintain persistent access to compromised systems. The FudModule rootkit has been in use since 2021 and is shared among various North Korean hacking groups, including Diamond Sleet and BlueNoroff. This zero-day exploit chain is part of a broader strategy by North Korean actors to target financial institutions and cryptocurrency firms for financial gain. The Citrine Sleet group has previously used similar tactics, such as fake job applications and weaponized software, to compromise their targets. This activity aligns with North Korea’s broader objective of generating revenue through cyber operations, having reportedly netted $3 billion from cryptocurrency attacks between 2017 and 2023. The U.S. government has added CVE-2024-7971 to its catalog of known exploited vulnerabilities, mandating federal agencies to patch the flaw by September 16, 2024.