Loading malware…
FudModule is a Windows rootkit associated with the North Korea-linked Lazarus Group, including activity attributed to Citrine Sleet. Observed since at least October 2021, it is primarily a post-compromise tool for suppressing endpoint security monitoring and concealing other malicious components. Its implementation includes user-mode DLLs that obtain kernel-memory access and directly manipulate operating-system structures, rather than relying solely on a conventional malicious kernel driver.
Early versions used Bring Your Own Vulnerable Driver techniques involving legitimately signed Dell and ENE Technology drivers, including exploitation of CVE-2021-21551. Later versions exploited vulnerabilities in built-in Windows drivers, including CVE-2024-21338 in the Application Identity driver and CVE-2024-38193 in the Ancillary Function Driver for Winsock. FudModule modifies kernel callback structures, interferes with file-system minifilters, tampers with Event Tracing for Windows, and suppresses execution-related forensic traces. Some variants incorporate debugger checks, victim-specific execution checks, memory-resident loading, and VMProtect packing.
Version 3.0 added crash-dump suppression and shellcode injection into Windows system processes, using kernel-memory manipulation to bypass Protected Process Light restrictions and stage an associated payload. Version 3.1, deployed through exploitation of CVE-2026-68820, additionally tampers with Windows Smart App Control to undermine software verification while retaining security-telemetry suppression capabilities.
FudModule has been delivered by other Lazarus malware, including Kaolin RAT, LPEClient, and MISTPEN-based deployment chains. Associated intrusions have used browser exploitation and recruitment-themed spearphishing. Operation Dream Job deployments targeted defense, aerospace, and aviation organizations, including victims in France, Germany, Brazil, and India. Other associated targeting has included cryptocurrency engineering professionals. FudModule's principal role is privileged concealment and security-control interference; credential collection, exfiltration, and remote access are generally performed by companion tools.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
In August 2026, researchers reported that the Lazarus group used a Windows zero-day in the AFD.sys driver to gain kernel privileges and deploy an updated version of its FudModule rootkit.
“Microsoft published a blogpost, describing Citrine Sleet using a zero-day Chrome exploit to launch an evasive rootkit called FudModule.”
The 2022 emergence of FudModule represents a significant development for LABYRINTH CHOLLIMA’s malware capabilities. FudModule employs direct kernel manipulation for stealth and has leveraged zero-day exploits in vulnerable drivers, Chrome, and Windows.
The 2022 introduction of Fudmodule advanced capabilities through direct kernel manipulation and zero-day exploitation in vulnerable drivers, Chrome, and Windows.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Operation Dream Job campaign targeting the defense, aerospace, and aviation sectors through spear-phishing, job-offer lures, impersonation websites, SEO poisoning, and trojanized PDF viewers.
Operation Dream Job campaign targeting the defense, aerospace, and aviation sectors through spear-phishing, job-offer lures, impersonation websites, SEO poisoning, and trojanized PDF viewers.
Operation Dream Job campaign targeting the defense, aerospace, and aviation sectors through spear-phishing, job-offer lures, impersonation websites, SEO poisoning, and trojanized PDF viewers.
Lazarus targets defense professionals with fake Lockheed Martin jobs... the long-running North Korean campaign that lures defense and aerospace professionals with convincing fake job offers.
Microsoft identified a North Korean threat actor exploiting a Chromium remote-code-execution (RCE) zero-day vulnerability ( CVE-2024-7971 ) which was based on a type of confusion issue in the V8 JavaScript engine and WebAssembly engine.
The practical risk is worse after a suspicious installer, fake job test, cracked app, remote-access lure or other payload has already reached the computer, because privilege escalation can help that payload hide, tamper with defenses or run with kernel-adjacent power.
Disable a security solution ability to monitor registry operations
L’exploit est suivi du déploiement d’un rootkit FudModule v3.1 , capable de masquer la présence de l’attaquant, désactiver les journaux et altérer la vérification d’intégrité des logiciels en cours d’exécution.
The process involves two consecutive shellcode injections into different processes: one into services.exe and the other into msiexec.exe.
they employed the Bring Your Own Vulnerable Driver (BYOVD) technique, a well-known method where attackers load a legitimate, signed, and vulnerable kernel driver to bypass the Driver Signature Enforcement (DSE) policy. | we discovered a sample that was exploiting a new zero-day vulnerability within Winsock driver ( CVE-2024-38193 ) to achieve local privilege escalation to deploy a new version of FudModule rootkit.
“Lazarus was already running with elevated privileges and then impersonated the local service account just prior to calling the IOCTL… using… NtSetInformationThread with the ThreadImpersonationToken… By impersonating local service, it can now obtain a read/write handle to \Device\AppId.”
L’exploit est suivi du déploiement d’un rootkit FudModule v3.1 , capable de masquer la présence de l’attaquant, désactiver les journaux et altérer la vérification d’intégrité des logiciels en cours d’exécution.
The RCE vulnerability was used to deploy a shellcode containing another exploit ( CVE-2024-38106 ) that was used to escape Chromium’s sandbox and deploy the downloaded FudModule rootkit into the memory.
MITRE ATT&CK catalogs the technique as T1014 under defense evasion.
...through spear-phishing, job-offer lures, impersonation websites, SEO poisoning, and trojanized PDF viewers.
The process involves two consecutive shellcode injections into different processes: one into services.exe and the other into msiexec.exe.
To disable crash dump, the rootkit first locates the virtual address of the data sections of the crashdmp.sys driver and ntoskrnl.exe ... It then zeroes out this pointer which effectively prevents the system from generating a crash dump.
“Lazarus was already running with elevated privileges and then impersonated the local service account just prior to calling the IOCTL… using… NtSetInformationThread with the ThreadImpersonationToken… By impersonating local service, it can now obtain a read/write handle to \Device\AppId.”
requesting the exploit itself, which it decrypted and ran in memory.
“followed by a low-effort anti-debug check on PEB.BeingDebugged.”
Disable a security solution ability to monitor registry operations
They described 7 techniques used to disarm security solutions and monitoring tools... Disable process, thread and image kernel callbacks Disabling all monitoring and antivirus file system minifilters Disable network traffic filtering ... Disable monitoring of MsMpEng.exe process
“leaking the base addresses of… ntoskrnl, netio, and fltmgr… calling NtQuerySystemInformation using the SystemModuleInformation class… KTHREAD address… using… SystemExtendedHandleInformation.”
“followed by a low-effort anti-debug check on PEB.BeingDebugged.”
After reconnaissance and persistence stages, it loaded a dedicated module to fetch the privilege escalation exploit.
80 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
41 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.