North Korea’s Lazarus Group Deploys New Kaolin RAT via Fake Job Lures
In summer 2023, the North Korea-affiliated threat actor Lazarus Group used its tried-and-true fake job lures to distribute a new remote access trojan named Kaolin RAT as part of attacks directed at certain targets in the Asia-Pacific area.
In addition to performing typical remote access tasks (RATs), the malware has the ability to modify the file's last write timestamp and load any DLL binary that is received from a command-and-control server, according to a report released last week by Avast security researcher Luigino Camastra.
The appid.sys driver's now-patched admin-to-kernel exploit (CVE-2024-21338, CVSS score: 7.8) allows the rootkit FudModule to be delivered via the RAT. Once inside, it can use this attack to get a kernel read/write primitive and eventually disable security p...