Lazarus hackers exploited Windows zero-day to gain Kernel privileges

### Executive Summary Avast analysts discovered Lazarus exploiting a flaw in the Windows AppLocker driver (CVE-2024-21338) to obtain a kernel-level primitive and deploy an updated FudModule rootkit and an undocumented RAT that can disable security products (including Microsoft Defender and CrowdStrike) and maintain stealthy persistence; Avast reported the activity to Microsoft, which released a February 2024 patch and provided YARA rules for detection.