Lazarus Group Exploited Windows Zero-day

The notorious Lazarus hacker group exploited a zero-day vulnerability in Microsoft Windows, targeting the Ancillary Function Driver for WinSock (AFD.sys), identified as CVE-2024-38193. Discovered by researchers Luigino Camastra and Milanek in June 2024, the flaw allowed unauthorized access to sensitive system areas, posing a global threat.

CVE-2024-38193

The CVE-2024-38193 vulnerability, an “Elevation of Privilege” flaw, allowed attackers to bypass security restrictions and access sensitive system areas.

Exploited through the “Fudmodule” malware, which evaded detection, the Lazarus group targeted professionals in cryptocurrency engineering and aerospace to infiltrate networks and steal cryptocurrencies, funding their operations. This sophisticated attack is valued at several hundred thousand dollars on the black market.

Microsoft Releases Critical Patch

In response to the threat, Microsoft quickly issued a patch for the critical vulnerability, thanks to the Gen cybersecurity team’s alert and detailed code analysis. This rapid action has secured all vulnerable Windows devices.

Users are urged to update their systems immediately. Gen’s dedication to digital freedom not only protects its customers but also safeguards the broader digital ecosystem by identifying and addressing emerging threats before they can cause widespread harm.

Gen’s alert to Microsoft protected millions of Windows users and reaffirmed its mission to enhance digital safety. The high-severity vulnerability, CWE-416 with a CVSS score of 7.8/7.2, was classified as “Important” by Microsoft, emphasizing the need for strong collaboration in cybersecurity.