Tag

#lazarus

1 post tagged #lazarus.

Analysis · May 20, 2026 · Colten Anderson

Lazarus didn't bring a vulnerable driver. They used the one already on every Windows PC.

The standard defense against driver-based kernel attacks is a blocklist of known-bad drivers. CVE-2024-21338 routes around it: the vulnerable driver is appid.sys, the AppLocker component Windows ships by default. You can't blocklist a core part of the OS.