🔴 Critical | Source: The Hacker News
North Korea’s Lazarus Group has exploited a now-patched zero-day vulnerability in Microsoft Windows to gain SYSTEM-level privileges and deploy a previously unknown backdoor. The campaign, dubbed Operation Dream Job, has targeted defence and aerospace companies in France, Germany, Brazil, and India. This is a highly sophisticated, state-sponsored attack leveraging the highest level of Windows access, making detection and containment particularly challenging.
Security Architect’s Take: Prioritise immediate deployment of the latest Microsoft Windows patches across all endpoints and server workloads, including cloud-hosted Windows VMs on Azure, AWS, and GCP. Review EDR telemetry for anomalous SYSTEM-level process creation and lateral movement patterns consistent with Lazarus TTPs, and enforce application allowlisting to limit backdoor execution opportunities.
Original advisory: Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor