{"uuid": "847590f6-7c97-4f3d-991f-3141b2e81018", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21551", "type": "seen", "source": "https://t.me/hacking_Attack/71502", "content": "Black Hat Ethical Hacking\nLazarus hackers abuse Dell driver bug using new FudModule rootkit\n\nLazarus hackers abuse Dell driver bug using new FudModule rootkitPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes The notorious North Korean hacking group \u2018Lazarus\u2019 was seen installing a Windows rootkit that abuses a Dell hardware driver in a Bring Your Own Vulnerable Driver attack.The spear-phishing campaign unfolded in the autumn of 2021, and the confirmed targets include an aerospace expert in the Netherlands and a political journalist in Belgium.\n\nAccording to ESET, which published a report on the campaign today, the primary goal was espionage and data theft.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Abusing Dell driver for BYOVD attacksThe EU-based targets of this campaign were emailed fake job offers, this time for Amazon, a typical\u00a0and common\u00a0social engineering trick employed by the hackers\u00a0in 2022.\n\nOpening these documents downloads a remote template from a hardcoded address, followed by infections involving malware loaders, droppers, custom backdoors, and more.\n\nESET reports that among the tools deployed in this campaign, the most interesting is a new FudModule rootkit that abuses a BYOVD (Bring Your Own Vulnerable Driver) technique to exploit a vulnerability in a Dell hardware driver for the first time.\n\n\u201cThe most notable tool delivered by the attackers was a user-mode module that gained the ability to read and write kernel memory due to the CVE-2021-21551 vulnerability in a legitimate Dell driver,\u201d explains ESET in a new report\u00a0on the attack.\n\n\u201cThis is the first ever recorded abuse of this vulnerability in the wild.\u201d\n\n\u201cThe attackers then used their kernel memory write access to disable seven mechanisms the Windows operating system offers to monitor its actions, like registry, file system, process creation, event tracing etc., basically blinding security solutions in a very generic and robust way.\u201d\n\nA Bring Your Own Vulnerable Driver (BYOVD) attack is when threat actors load legitimate, signed drivers in Windows that also contain known vulnerabilities. As the kernel drivers are signed, Windows will allow the driver to be installed in the operating system.\n\nHowever, the threat actors can now exploit the driver\u2019s vulnerabilities to launch commands with kernel-level privileges.\n\nIn this attack, Lazarus was exploiting the CVE-2021-21551 vulnerability in a Dell hardware driver\u00a0(\u201cdbutil_2_3.sys\u201d), which corresponds to a set of five flaws\u00a0that remained exploitable for 12 years before the computer vendor finally pushed security updates for it.\nhttps://www.bleepstatic.com/images/news/security/vulnerabilities/dbutil-properties.jpg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:36.553719Z"}