The North Korea-backed Lazarus Group not solely appears to focus on blockchain builders and artists areones with faux job affords. They’re now additionally focusing on Aerospace consultants and political journalists in Europe. The purpose price mentioning right here is that it was the identical type of social engineering assaults, with the identical aim of company espionage and knowledge exfiltration from enterprise units. The group has been noticed deploying a Home windows rootkit by benefiting from an exploit in Dell drivers. So, what makes this marketing campaign distinctive is the truth that the targets have been contaminated with respectable drivers.
HACKERS are Exploiting Dell Drivers’ Vulnerability
Lately, Cybersecurity researchers from ESET have seen Lazarus Group, a identified North Korean state-sponsored menace actor that was seen approaching people with faux job affords from Amazon. These unlucky who accepted the supply, and downloaded faux job description PDF recordsdata, have had an outdated, weak Dell driver put in. So, this opened the doorways for the menace actors to compromise the endpoints, and exfiltrate no matter knowledge they have been on the lookout for. ESET stated that:
“Essentially the most notable instrument delivered by the attackers was a user-mode module that gained the flexibility to learn and write kernel reminiscence because of the CVE-2021-21551 vulnerability in a respectable Dell driver. That is the primary ever recorded abuse of this vulnerability within the wild.”
Because of this, the Lazarus group was given the flexibility to disable a few of Home windows’ monitoring mechanisms, permitting it to tweak the registry, file system, course of creation, occasion tracing, and far more. ESET additional said that this “mainly blinded safety options in a really generic and strong approach.”
CVE-2021-21551 vulnerability encompasses 5 completely different flaws that have been flying underneath the radar for 12 years earlier than Dell lastly fastened it. The hacker’s group used it to deploy its HTTP(S) backdoor “BLINDINGCAN”, a distant entry trojan (RAT) that is ready to:
- execute numerous instructions
- take screenshots from the compromised endpoints
- create and terminate numerous processes
- exfiltrate knowledge and system data
Furthermore, the menace actor used the vulnerabilities to deploy FudModule Rootkit, an HTTP(S) uploader, in addition to compromised open-source apps wolfSSL and FingerText.
Additionally Learn: Kim Kardashian Will Pay $1.26 Million For Selling EthereumMax (phoneworld.com.pk)