North Korea's Lazarus Group Deploys New Kaolin RAT via Fake Job Lures

The report documents Lazarus Group’s Operation Dream Job (summer 2023), where fabricated job-offer lures delivered a multi-stage infection chain that loads Kaolin RAT and then deploys the FudModule rootkit; the chain uses side‑loading, in-memory loaders (RollFling/RollSling/RollMid), steganographic C2 retrieval, and exploited a patched kernel driver vulnerability (CVE-2024-21338) to gain kernel read/write and disable security, enabling file enumeration/manipulation, process control, DLL loading, and C2 data exfiltration.