A North Korean-linked APT group exploited a zero-day vulnerability in the Windows AppLocker driver (appid.sys) to gain kernel-level access to a target system

An APT group linked to North Korea is exploiting a zero-day vulnerability in the appid.sys AppLocker driver using an admin-to-kernel exploit. A zero-day exploit, identified as CVE-2024-21338, was addressed by Microsoft in February.

The flaw CVE-2024-21338 resides within the IOCTL (Input and Output Control) dispatcher of the driver appid.sys. In the AppLocker application, this driver controls which apps and files users can run. Lazarus exploited the zero-day in the appid.sys driver by manipulating the Input and Output Control (IOCTL) dispatcher. As a result of this manipulation, they can execute arbitrary code on the target system, bypassing security mechanisms.

Japanese organizations must follow the instructions provided by Microsoft Security Response Center and also install drivers and apply patches to old applications and software.