Week of August 19, 2024

In February 2024, CISA reported that Volt Typhoon threat actors removed legitimate security tools and cleared logs on compromised systems to hide their presence. The group used built-in administrative commands to uninstall EDR, disable Windows Defender, and delete event logs, enabling long-term undetected access to U.S. critical infrastructure.

Microsoft patched CVE-2024-38193, a privilege escalation vulnerability in the Windows Ancillary Function Driver (AFD.sys), which was actively exploited by the North Korea-linked Lazarus APT group. The flaw allowed attackers to gain SYSTEM privileges and was used alongside the FudModule rootkit to bypass security software. This follows Lazarus's earlier exploitation of CVE-2024-21338 in the AppLocker driver for kernel-level access.

IBM released a security bulletin addressing multiple vulnerabilities in Security QRadar EDR. CVE-2024-37890 allows unauthenticated remote code execution via a buffer overflow, while CVE-2024-37891 enables authenticated privilege escalation. Patches are available in the August 2024 update.