EB9DBCEC9E90EBA3A8EC8AA4-EAB3B5EAB2A9-EAB7B8EBA3B9EC9D98-BYOVDEBA5_RGTTvPV.pdf (1 MB)

AhnLab's report analyzes Lazarus rootkit malware that uses a bring-your-own-vulnerable-driver technique to obtain kernel-level capabilities. The PDF frames the case as part of Lazarus activity tracked by ASEC against South Korean defense, satellite, software, media, and other organizations since 2021. The report focuses on the malware's driver-abuse approach, rootkit behavior, and forensic artifacts, showing how Lazarus can use vulnerable legitimate components to interfere with detection and maintain deeper control over compromised Windows systems.