Topic
Lazarus
Security Week 2644: Active Exploitation of PHP2Shell Vulnerabilities Confirmed
Vulnerabilities & Exploits
Bybit Restricts Transfers to Sanctioned Entities Including Lazarus Group and CryptoPro
Policy & Regulation
Deepfakes Turn Job Interviews into Cyberattack Vectors Targeting IT Candidates and Recruiters
AI SecurityLazarus Group Exploits Windows Kernel Zero-Day CVE-2026-68820 to Deploy FudModule Rootkit
The North Korean Lazarus APT group has been actively exploiting a zero-day vulnerability in the Windows kernel to escalate privileges to SYSTEM level and install the FudModule rootkit. The flaw, tracked as CVE-2026-68820, resides in the afd.sys driver responsible for network functions and socket management. Microsoft released a patch for the issue on August 11. The attacks form part of the ongoing Operation Dream Job campaign, which uses fake job offers to target professionals in defense, aerospace, and aviation sectors. Victims in Brazil, Europe, and India are tricked into opening malicious PDF viewers or prepared files that deliver the MISTPEN downloader. Once initial access is obtained, the zero-day exploit elevates privileges, allowing FudModule to tamper with Windows telemetry and weaken EDR solutions as well as Smart App Control.
YARA Style Guide: Comprehensive Best Practices for Naming, Structuring and Maintaining Detection Rules
The article presents a detailed translation and adaptation of Florian Roth's YARA Style Guide, aimed at bringing consistency to large collections of YARA rules used by security teams. It explains how to construct informative rule names that include threat category, context, operating system, architecture, technology, packers and creation date, using prefixes such as MAL, HKTL, WEBSHELL, EXPL, VULN, SUSP and PUA. The guide recommends specific metadata fields including description, author, date, reference, score and hash, along with a three-tier string categorization system using $x*, $s* and $a* prefixes for high-specificity, group and preliminary strings. It also covers false-positive filters marked with $fp*, proper indentation, readable hex and string formatting, and a recommended order of conditions that begins with header checks and ends with false-positive filters. The publication highlights the benefits of this structured approach for long-term maintainability and faster triage during mass detections. Additional references point to the separate YARA-Performance-Guidelines project for deeper optimization techniques.