Microsoft links the recent Chrome zero-day exploit to North Korean threat actors, targeting the cryptocurrency sector with advanced malware techniques
A North Korea-linked cyber group known as Citrine Sleet (also referred to as AppleJeus, Labyrinth Chollima, UNC4736, and Hidden Cobra) has exploited the recently patched Google Chrome zero-day vulnerability, CVE-2024-7971, to deploy the sophisticated FudModule rootkit, according to a statement by Microsoft.
Microsoft researchers have linked the attacks with medium confidence to Citrine Sleet, a North Korean threat actor known for targeting the cryptocurrency sector for financial gain. The FudModule rootkit, however, is also associated with Diamond Sleet, another North Korean cyberespionage group. Microsoft has previously identified shared infrastructure and tools between these groups, suggesting potential collaboration in using the FudModule malware.
The CVE-2024-7971 vulnerability, which affects versions of Chromium before 128.0.6613.84, enables threat actors to achieve remote code execution (RCE) within the sandboxed Chromium renderer process if exploited.
According to Microsoft, the attack by Citrine Sleet followed typical stages of a browser exploit chain. The targets were directed to an exploit domain controlled by Citrine Sleet, voyagorclub[.]space, where the zero-day RCE exploit for CVE-2024-7971 was served. While the exact method used to direct targets to this domain remains unconfirmed, social engineering is a common tactic employed by Citrine Sleet.
Once the RCE exploit successfully executed code within the sandboxed Chromium renderer process, shellcode containing a Windows sandbox escape exploit and the FudModule rootkit was downloaded and loaded into memory. The FudModule rootkit, after escaping the sandbox, was executed in memory, utilising direct kernel object manipulation (DKOM) techniques to interfere with kernel security mechanisms. The rootkit operates entirely from user mode and manipulates the kernel through a kernel read/write primitive. Notably, no further malware activity was observed on the targeted devices.
The sandbox escape exploited a separate flaw, CVE-2024-38106, an elevation of privilege vulnerability in the Windows kernel, which Microsoft addressed on 13 August 2024.
Microsoft’s report highlights that while CVE-2024-38106 was exploited, their investigation has not yet established a direct link between this vulnerability and Citrine Sleet’s activities, beyond the use of the same exploit. This suggests a possible “bug collision,” where the same vulnerability was independently discovered by separate threat actors or shared among multiple groups.
In light of these developments, Microsoft recommends that organisations keep their systems up to date and implement security solutions that provide unified visibility across the cyberattack chain. This approach can help detect and block post-compromise attacker tools and malicious activity following exploitation. Additionally, strengthening the configuration of the operating environment is advised to mitigate such threats effectively.
