Exploit / PoCcritical
North Korea-linked APT Citrine Sleet exploit Chrome zero-day to deliver FudModule rootkit
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-38106 | Local Privilege Escalation in Microsoft Windows Kernel (CVE-2024-38106) | 7.0 | 6% | KEV | KEV |
| CVE-2024-7971 | Type Confusion in Google Chromium V8 Enables Heap Corruption via Malicious Pages | 9.6 | 21% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | voyagorclub.space | ere directed to the Citrine Sleet-controlled exploit domain voyagorclub[.]space. While we cannot confirm at this time how the targets wer |
From the original article
2 min read at securityaffairs.com
North Korea-linked APT exploited the recently patched Google Chrome zero-day CVE-2024-7971 to deploy the FudModule rootkit. North Korea-linked group Citrine Sleet (aka AppleJeus , Labyrinth Chollima , UNC4736, Hidden Cobra ) have exploited the recently patched Google Chrome zero-day CVE-2024-7971 (CVSS score 8. 8) to deploy the FudModule rootkit , states Microsoft.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.