FudModuleMalware
- lightshow
FudModule is a user-mode DLL that gets the ability to read and write arbitrary kernel memory via the BYOVD technique. Its main goal is to turn off Windows system monitoring features, which is done by modifying kernel variables and removing kernel callbacks. Its actions may very likely affect various types of security products, e.g. EDRs, firewalls, antimalware and even digital forensics tools.From MISP Galaxy
Last reported 3 days ago, by Kaspersky Securelist4 reports
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1014Rootkit
“What arrived through the handshake was FudModule, Lazarus's kernel rootkit, in a build Check Point tracks as v3.1.It disables telemetry callbacks, removes minifilters, kills the NT Kernel Logger and blinds 94 Event Tracing for Windows (ETW) providers.”
- T1505.003Web Shell
“… leveraged these credentials to authenticate to the affected Roundcube instances before exploiting CVE-2025-49113 to deploy RelayShell web shells, which subsequently serve as a C2 relay mechanism.”
- T1195Supply Chain Compromise
“In regards to cybercrime, we noted a Rust crates supply-chain compromise via typosquatted dependency, with infrastructure overlapping with operations attributed to North Korea-linked threat actors.”
- T1213.005Messaging Applications
“… that the threat actor likely approached targets through professional networking platforms such as LinkedIn, or directly through messaging applications.”
- T1543.003Windows Service
“…echHub in the chain: an in‑memory version, a simple DLL side‑loading version, and a DLL side‑loading version that uses a registered Windows service.”
- T1564.003Hidden Window
“OPEN|<exe> [args]Process creationLaunches an executable with arguments in a hidden window with no console.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Operation FlashHole: Lazarus breaks security, defies control“Recent research conducted by Check Point revealed that LPEClient was used to deploy the FudModule malware using a zero-day.”
-
Cyber Brief 26-09 - August 2026“…in vulnerable Roundcube servers to relay C2 traffic and also exploited CVE-2026-68820, a zero-day vulnerability in Windows to deploy a FudModule rootkit.”
-
Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day“What arrived through the handshake was FudModule, Lazarus's kernel rootkit, in a build Check Point tracks as v3.1.It disables telemetry callbacks, removes minifilters, kills the NT Kernel Logger and blinds 94 Event Tracing for Windows (ETW) providers.”
-
Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack“…usion, the threat actor exploited CVE-2026-68820, a zero-day vulnerability in the Microsoft AFD.sys driver, to deploy a new version of FudModule, Lazarus’ kernel-mode rootkit.”
Indicators in its reports
named in the reports above- 2b4987c07a3d9a9a…c92874265ca8in 1 report
- 3a02d0d798e8d355…5d259516525ain 1 report
- 92106b0c62a0a426…c70cfe98afa1in 1 report
- 396192d92d17ace1…8e4934b3c82cin 1 report
- f7e620134ca93506…cc9b75afda4din 1 report
- 75b93a7103b0562f…4469a7f096f1in 1 report
- a45144d22cac70a4…ac863d6cc7e2in 1 report
- 1de949c71efcfb0f…8c535d7ad86cin 1 report
- 4c9b804d6155b29f…6bf2026768d9in 1 report
- 29e24c007549e513…53bd3f4533a2in 1 report
- 4ebdce2f47c23ff8…926890adc105in 1 report
- c2aa28bb5e2a749c…ee5fb4167461in 1 report
- 2db25ac41a66aa52…bd7232e141ebin 1 report
- 5278ee922838352f…97dfd088696din 1 report
- b4082d21070d9ddf…35e458d21afbin 1 report
- fb3fc5626f68677f…6a8210139a2din 1 report
- ea7056f2bf36c66a…c2504db2c619in 1 report
- 13d10bc99f7f7abe…40dacbcdef79in 1 report
- 4fd32432341dfcf5…a340cdde9a2din 1 report
- 4dd792c9f672bbdc…79a48ad6a68ain 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.