Flagthis: North Korean APT Group Citrine Sleet Exploits Chrome Zero-Day Vulnerability

North Korean APT Group Citrine Sleet Exploits Chrome Zero-Day Vulnerability - 10d

A North Korean APT group known as Citrine Sleet has been linked to the exploitation of a zero-day vulnerability in the Chromium browser, specifically CVE-2024-7971. This vulnerability, a type confusion flaw in the V8 JavaScript and WebAssembly engine, allowed for remote code execution (RCE) in the sandboxed Chromium renderer process. The threat actor, known as Citrine Sleet, primarily targets the cryptocurrency sector and has been observed deploying the FudModule rootkit to gain persistence on compromised systems. This incident highlights the ongoing threat posed by North Korean state-sponsored actors and the importance of patching vulnerabilities promptly.

References

CyberInsider - North Korean Hackers ‘Citrine Sleet’ Exploited Zero-Day in Chrome
@BleepingComputer - North Korean hackers have exploited a recently patched Google Chrome zero-day (CVE-2024-7971) to deploy the FudModule rootkit after gaining SYSTEM privileges using a Windows Kernel exploit.
Security Affairs - North Korea-linked APT exploited Chrome zero-day to deliver FudModule rootkit
@patrickcmiller - North Korea-linked APT Citrine Sleet exploit Chrome zero-day to deliver FudModule rootkit - Security Affairs
www.microsoft.com - North Korean threat actor Citrine Sleet exploiting Chromium zero-day

Classification:

Type: Vulnerability
Severity: Major
Company: Google
Target: Cryptocurrency Sector
Attacker: Citrine Sleet
Product: Chromium
Feature: V8 JavaScript

Flag This

North Korean APT Group Citrine Sleet Exploits Chrome Zero-Day Vulnerability - 10d