The infamous Lazarus Group is exploiting a zero-day vulnerability to disable antivirus programs on targeted Windows endpoints, new research has claimed.
Cybersecurity experts from Avast said they observed a new campaign from the North Korean state-sponsored hackers, which now leverages a flaw in the Windows AppLocker driver. This flaw, tracked as CVE-2024-21338, allowed them to gain kernel-level access to the device. They used it to disable any antivirus programs installed on the device, opening the doors for more disruptive malware.
