VB2022-Kalnai-Havranek.pdf (3 MB)

ESET documents FudModule, an 88,064-byte user-mode DLL used in a Lazarus attack on a corporate endpoint in the Netherlands in October 2021. The module was delivered alongside other Lazarus-attributed tools such as HTTP(S) backdoors, downloaders, and uploaders, although the full delivery chain was not recovered. FudModule used the BYOVD technique by dropping and loading Dell’s signed DBUtil_2_3.sys driver, then triggering CVE-2021-21551 to rewrite the current thread’s PreviousMode field and enable kernel memory writes from user mode. After that access was obtained, it attempted to disable monitoring mechanisms such as registry callbacks so security tools would lose visibility into system activity.