North Korean Cyber Threats: The Exploitation of Google Chrome’s Zero-Day Vulnerability

On August 31, 2024, a significant cybersecurity incident came to light, revealing the exploitation of a recently patched security flaw in Google Chrome and other Chromium-based web browsers. This vulnerability was leveraged by North Korean cyber actors in a sophisticated campaign aimed at deploying the FudModule rootkit. This incident underscores the persistent and evolving tactics employed by nation-state adversaries, particularly those associated with North Korea.

The Threat Actor: Citrine Sleet

The activity was detected by Microsoft on August 19, 2024, and attributed to a threat actor known as Citrine Sleet. This group, previously identified as DEV-0139 and DEV-1222, is part of the larger Lazarus Group, which has been linked to various cyber-espionage and financial theft operations. The Lazarus Group, also referred to as Diamond Sleet and Hidden Cobra, has a notorious reputation for its sophisticated cyber operations, particularly targeting financial institutions and cryptocurrency platforms.

Citrine Sleet’s primary focus is on financial gain, specifically targeting organizations and individuals involved in cryptocurrency. The Microsoft Threat Intelligence team noted that the group employs extensive reconnaissance tactics to identify potential victims within the cryptocurrency industry.

The Exploit: CVE-2024-7971

The zero-day exploit utilized in this attack involved a high-severity type confusion vulnerability in the V8 JavaScript and WebAssembly engine, designated as CVE-2024-7971. This vulnerability allows threat actors to execute remote code in the sandboxed Chromium renderer process, effectively bypassing security measures. Google promptly patched this flaw as part of its updates released the week prior to the attack.

CVE-2024-7971 is notable for being the third actively exploited type confusion bug in V8 that Google has resolved in 2024, following CVE-2024-4947 and CVE-2024-5274. The exploitation of such vulnerabilities highlights the ongoing challenges faced by software developers in securing their products against increasingly sophisticated cyber threats.

The Attack Chain

The attack chain orchestrated by Citrine Sleet typically involves setting up fraudulent websites that masquerade as legitimate cryptocurrency trading platforms. These sites are designed to deceive users into downloading weaponized cryptocurrency wallets or trading applications, ultimately facilitating the theft of digital assets.

In this particular incident, victims were reportedly directed to a malicious website named voyagorclub[.]space, likely through social engineering techniques. Once users engaged with the site, the exploit for CVE-2024-7971 was triggered, allowing the attackers to gain remote code execution.

This exploit paves the way for the retrieval of shellcode containing a Windows sandbox escape exploit (CVE-2024-38106) and the FudModule rootkit. The FudModule rootkit is particularly dangerous, as it establishes admin-to-kernel access to Windows-based systems, enabling attackers to perform direct kernel object manipulation and execute read/write primitive functions.

The Broader Context: Vulnerabilities and Exploits

CVE-2024-38106, a Windows kernel privilege escalation vulnerability, is one of six actively exploited security flaws that Microsoft addressed in its August 2024 Patch Tuesday update. Notably, the exploitation of this flaw by Citrine Sleet occurred after the fix was released, raising concerns about the potential for "bug collisions." This phenomenon occurs when multiple threat actors independently discover the same vulnerability, or when knowledge of a vulnerability is shared among different actors.

Citrine Sleet’s exploitation of CVE-2024-7971 marks the third instance this year where North Korean threat actors have leveraged vulnerabilities to deploy the FudModule rootkit. Previous exploits included CVE-2024-21338 and CVE-2024-38193, both of which were privilege escalation flaws in built-in Windows drivers.

Conclusion: The Importance of Vigilance

The recent activities of Citrine Sleet serve as a stark reminder of the evolving landscape of cyber threats. Zero-day exploits like CVE-2024-7971 necessitate not only keeping systems up to date but also implementing robust security solutions that provide unified visibility across the cyberattack chain. Organizations must remain vigilant and proactive in their cybersecurity measures to detect and block post-compromise attacker tools and malicious activities following exploitation.

As the cyber threat landscape continues to evolve, it is crucial for individuals and organizations, especially those in the cryptocurrency space, to stay informed and adopt best practices in cybersecurity to mitigate risks associated with such sophisticated attacks.

For more insights and updates on cybersecurity, follow us on Twitter and LinkedIn. Stay safe and secure in the digital world!