North Korean hackers exploit Chrome zero-day to deploy rootkit

Microsoft attributes active exploitation of a Chrome zero-day (CVE-2024-7971) to the North Korean-linked group Citrine Sleet, who redirected victims to attacker-controlled sites to achieve remote code execution, chained a Windows kernel exploit (CVE-2024-38106) to gain SYSTEM privileges, and loaded the FudModule rootkit for kernel tampering and DKOM; the actor targets the cryptocurrency sector and has used supply-chain and trojanized software techniques in prior campaigns.