Loading malware…
FudModule is a Lazarus Group kernel-mode Windows rootkit used in post-compromise privilege escalation, stealth, and security-tool suppression. It has been observed in multiple evolutionary stages since at least 2021–2022 and is closely associated with North Korean espionage operations, including Operation Dream Job. The malware has targeted Windows environments in campaigns affecting defense, aerospace, aviation, finance, media, pharmaceutical, and cryptocurrency-related organizations, with repeated use against high-value victims in Asia, Europe, and South America.
Early FudModule variants used bring-your-own-vulnerable-driver techniques to obtain kernel memory access through signed but vulnerable drivers. Later versions shifted to exploiting built-in Windows drivers directly, including appid.sys and AFD.sys, to gain kernel read/write capability and elevate privileges to SYSTEM without relying on a separately dropped vulnerable driver. Observed exploitation chains include CVE-2024-21338, CVE-2024-38193, and CVE-2026-68820. These exploit paths enabled direct kernel object manipulation and other low-level tampering needed to conceal malicious activity and weaken host defenses.
FudModule’s core function is defense evasion at kernel level. Documented behavior includes disabling or degrading security monitoring by tampering with minifilters, process/thread/image notification callbacks, registry callbacks, object callbacks, Windows Filtering Platform structures, ETW visibility, logging components, and the NT Kernel Logger. Newer variants also interfere with Windows Smart App Control and software integrity verification mechanisms. Earlier reporting also documented selective victim validation, version-aware kernel offset handling, and anti-analysis packing.
The malware has also evolved beyond a pure security-disabling implant into a protected execution and staging component for follow-on payloads. Version 3.x has been observed using kernel access to disable crash-dump generation, manipulate process protections, and support injection of shellcode or additional malware into privileged processes, including launching payloads from protected contexts to reduce EDR visibility. In 2026 Lazarus used FudModule v3.1 after initial compromise through recruiter-themed social engineering and trojanized PDF workflows, alongside MISTPEN, ForestTiger, and Troy.
FudModule is best characterized as a kernel rootkit for Windows that provides privilege escalation support, persistence-enabling stealth, and broad suppression of endpoint security telemetry during advanced intrusions.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
On August 19, 2024, Microsoft identified a North Korean threat actor exploiting a Chromium remote-code-execution (RCE) zero-day vulnerability ( CVE-2024-7971 )... Microsoft noted that Citrine Sleet used Chromium exploit to deploy a FudModule rootkit. | In early June, we discovered a sample that was exploiting a new zero-day vulnerability within Winsock driver (CVE-2024-38193) to achieve local privilege escalation to deploy a new version of FudModule rootkit.
The RCE vulnerability was used to deploy a shellcode containing another exploit ( CVE-2024-38106 ) that was used to escape Chromium’s sandbox and deploy the downloaded FudModule rootkit into the memory. | In early June, we discovered a sample that was exploiting a new zero-day vulnerability within Winsock driver (CVE-2024-38193) to achieve local privilege escalation to deploy a new version of FudModule rootkit.
In early June, we discovered a sample that was exploiting a new zero-day vulnerability within Winsock driver ( CVE-2024-38193 ) to achieve local privilege escalation to deploy a new version of FudModule rootkit. | In early June, we discovered a sample that was exploiting a new zero-day vulnerability within Winsock driver (CVE-2024-38193) to achieve local privilege escalation to deploy a new version of FudModule rootkit.
Previous versions of FudModule (v2.0) were delivered by Kaolin RAT, utilizing another zero-day exploit ( CVE-2024-21338 ) to gain read/write access to the kernel memory. | In early June, we discovered a sample that was exploiting a new zero-day vulnerability within Winsock driver (CVE-2024-38193) to achieve local privilege escalation to deploy a new version of FudModule rootkit.
The rootkit is compressed into a Vmprotect executable to disrupt analysis and contains the following two export functions. Compile time: 05/24/2022 12:15:32 (UTC) ... DLL name: FudModule.dll. According to AhnLab's ASD infrastructure, the Lazarus Group distributed the rootkit in 2 formats: DLL (~BIT353.tmp) and fileless formats.
This exploit enables the attackers to deploy a rootkit known as FudModule v3.1, which disables logging systems, suppresses security software and, in the newest version, also disrupts Smart App Control, Check Point said.
Attackers deployed MISTPEN, Troy RAT, ForestTiger, and FudModule, including the exploitation of the CVE-2026-68820 zero-day in Windows AFD.sys for local privilege escalation and SYSTEM-level access.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In early June, we discovered a sample that was exploiting a new zero-day vulnerability within Winsock driver (CVE-2024-38193) to achieve local privilege escalation to deploy a new version of FudModule rootkit.
In early June, we discovered a sample that was exploiting a new zero-day vulnerability within Winsock driver (CVE-2024-38193) to achieve local privilege escalation to deploy a new version of FudModule rootkit.
The 2022 emergence of FudModule represents a significant development for LABYRINTH CHOLLIMA’s malware capabilities. FudModule employs direct kernel manipulation for stealth and has leveraged zero-day exploits in vulnerable drivers, Chrome, and Windows.
The 2022 introduction of Fudmodule advanced capabilities through direct kernel manipulation and zero-day exploitation in vulnerable drivers, Chrome, and Windows.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
Operation Dream Job campaign targeting the defense, aerospace, and aviation sectors through spear-phishing, job-offer lures, impersonation websites, SEO poisoning, and trojanized PDF viewers.
Operation Dream Job campaign targeting the defense, aerospace, and aviation sectors through spear-phishing, job-offer lures, impersonation websites, SEO poisoning, and trojanized PDF viewers.
The process involves two consecutive shellcode injections into different processes: one into services.exe and the other into msiexec.exe.
they employed the Bring Your Own Vulnerable Driver (BYOVD) technique, a well-known method where attackers load a legitimate, signed, and vulnerable kernel driver to bypass the Driver Signature Enforcement (DSE) policy. | we discovered a sample that was exploiting a new zero-day vulnerability within Winsock driver ( CVE-2024-38193 ) to achieve local privilege escalation to deploy a new version of FudModule rootkit.
kernel szintű rootkitet (FudModule) telepítenek, és hosszú távú hozzáférést létesítenek a kompromittált rendszereken
...through spear-phishing, job-offer lures, impersonation websites, SEO poisoning, and trojanized PDF viewers.
The process involves two consecutive shellcode injections into different processes: one into services.exe and the other into msiexec.exe.
They described 7 techniques used to disarm security solutions and monitoring tools... Disable process, thread and image kernel callbacks Disabling all monitoring and antivirus file system minifilters Disable network traffic filtering ... Disable monitoring of MsMpEng.exe process
78 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Lazarus rootkit deployed after kernel privilege escalation. It disables logging, suppresses security tools, and in the latest version interferes with Smart App Control.
Kernel-level rootkit deployed by Lazarus after exploiting CVE-2026-68820 to gain elevated privileges on compromised systems.
Kernel-level rootkit deployed after exploitation of a Windows local privilege escalation vulnerability to gain SYSTEM privileges, evade endpoint protections, and maintain long-term stealthy access.
A Lazarus kernel-mode rootkit used post-exploitation; version 3.1 can tamper with Windows Smart App Control to bypass software verification.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.