Lazarus Hackers Exploited Windows Kernel Flaw as Zero-Day in Recent Attacks

The report describes Lazarus Group exploiting a zero-day Windows kernel privilege escalation (CVE-2024-21338) in the appid.sys driver to obtain kernel-level access and deploy the FudModule rootkit, which can disable a range of security products and evade detection; Microsoft revised the flaw's exploitability to “Exploitation Detected,” and Avast analyzed real-world weaponization that expands BYOVD techniques into an in-place driver zero-day exploit.