--- title: North Korean Hackers Exploit Chrome Zero-Day to Deploy... description: A North Korean Advanced Persistent Threat group called Citrine Sleet has been exploiting a zero-day vulnerability (CVE-2024-7971) in Chromium's V8 engine to... canonical: https://daily.dev/posts/north-korean-hackers-exploit-chrome-zero-day-to-deploy-fudmodule-rootkit-and-steal-cryptocurrency-1tbd8cs3o twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: North Korean Hackers Exploit Chrome Zero-Day to Deploy FudModule Rootkit and Steal Cryptocurrency | daily.dev og:description: A North Korean Advanced Persistent Threat group called Citrine Sleet has been exploiting a zero-day vulnerability (CVE-2024-7971) in Chromium's V8 engine to... og:url: https://daily.dev/posts/north-korean-hackers-exploit-chrome-zero-day-to-deploy-fudmodule-rootkit-and-steal-cryptocurrency-1tbd8cs3o og:image: https://api.daily.dev/og/posts/1tBD8cS3o.png og:image:alt: North Korean Hackers Exploit Chrome Zero-Day to Deploy FudModule Rootkit and Steal Cryptocurrency og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # North Korean Hackers Exploit Chrome Zero-Day to Deploy FudModule Rootkit and Steal Cryptocurrency **[Collections](https://daily.dev/sources/collections)** · 2 min read · 4 upvotes · 0 comments ## Summary A North Korean Advanced Persistent Threat group called Citrine Sleet has been exploiting a zero-day vulnerability (CVE-2024-7971) in Chromium's V8 engine to gain remote code execution. They deployed the sophisticated FudModule rootkit, employing advanced social engineering tactics to steal cryptocurrency from financial institutions. Users are advised to update Chromium and adopt robust security measures to protect against such threats. ## Content # North Korean Group Citrine Sleet Exploits Chromium Zero-Day to Deploy FudModule Rootkit and Steal Cryptocurrency A sophisticated North Korean Advanced Persistent Threat (APT) group known as Citrine Sleet has recently been identified exploiting the CVE-2024-7971 zero-day vulnerability in Chromium to achieve remote code execution (RCE). This vulnerability, a critical type confusion flaw in the V8 JavaScript and WebAssembly engine of Chromium, has been actively leveraged by the group to target the financial sector, particularly institutions involved with cryptocurrency. ## Exploitation Details CVE-2024-7971, the zero-day vulnerability, allowed Citrine Sleet to execute remote code on vulnerable systems before the patch was released by Google. The quick exploitation involved delivering a sophisticated rootkit known as FudModule, which uses Direct Kernel Object Manipulation (DKOM) techniques and operates from user mode, severely impacting kernel security. The group also exploited an additional Windows kernel vulnerability (CVE-2024-38106) for privilege escalation, ensuring deeper system access. ## Tactics and Impact Citrine Sleet employs advanced social engineering techniques, often creating fake cryptocurrency trading platforms to lure victims. Through these deceptive platforms, they manage to install weaponized applications, including malware such as AppleJeus, to gain control over victims' cryptocurrency assets. Microsoft has linked this activity to a subgroup within the notorious Lazarus Group, highlighting their persistent efforts in using multiple zero-day vulnerabilities for financial gain. In their recent campaigns, the attackers aimed primarily at financial institutions and cryptocurrency managers. By deploying the FudModule rootkit and leveraging the Chromium and Windows vulnerabilities, they achieved full control over targeted systems, siphoning off significant cryptocurrency assets. These stolen funds are believed to support North Korea's nuclear program, underscoring the geopolitical implications of such cyber activities. ## Mitigation and Recommendations Users and organizations are advised to update to the latest version of Chromium to protect against the CVE-2024-7971 vulnerability. Additionally, implementing comprehensive security solutions, including endpoint protection and vigilant monitoring of network activities, can help mitigate the risks posed by such advanced threats. Financial institutions, particularly those involved with cryptocurrency, should remain vigilant and adopt robust security protocols to safeguard their digital assets. In summary, the Citrine Sleet group's exploitation of the Chromium zero-day vulnerability to deploy the FudModule rootkit and target the cryptocurrency industry exemplifies the growing sophistication and financial motivations of North Korean cyber actors. Staying informed and adopting proactive security measures are crucial in defending against such high-stakes cyber threats. ## Similar posts on daily.dev - [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 1 upvotes · 0 comments - [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments - [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments - [CNCF Unveils Schedule for KubeCon \+ CloudNativeCon Europe 2026](https://daily.dev/posts/cncf-unveils-schedule-for-kubecon-cloudnativecon-europe-2026-ikhcoa5cb) · CNCF · 2 upvotes · 0 comments - [CNCF Debuts KubeCon \+ CloudNativeCon Japan 2026 Schedule](https://daily.dev/posts/cncf-debuts-kubecon-cloudnativecon-japan-2026-schedule-xp5pyudub) · CNCF · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#crypto](https://daily.dev/tags/crypto), [#google-chrome](https://daily.dev/tags/google-chrome) [View this post on daily.dev](https://daily.dev/posts/north-korean-hackers-exploit-chrome-zero-day-to-deploy-fudmodule-rootkit-and-steal-cryptocurrency-1tbd8cs3o) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"North Korean Hackers Exploit Chrome Zero-Day to Deploy FudModule Rootkit and Steal Cryptocurrency","url":"https://daily.dev/posts/north-korean-hackers-exploit-chrome-zero-day-to-deploy-fudmodule-rootkit-and-steal-cryptocurrency-1tbd8cs3o","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/north-korean-hackers-exploit-chrome-zero-day-to-deploy-fudmodule-rootkit-and-steal-cryptocurrency-1tbd8cs3o"},"datePublished":"2024-08-31T16:07:20.319Z","dateModified":"2024-09-04T08:10:07.335Z","description":"A North Korean Advanced Persistent Threat group called Citrine Sleet has been exploiting a zero-day vulnerability (CVE-2024-7971) in Chromium's V8 engine to...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/315742b67ff1d268b1b1c3bcd75e652b?_a=AQAEuiZ","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/315742b67ff1d268b1b1c3bcd75e652b?_a=AQAEuiZ","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/north-korean-hackers-exploit-chrome-zero-day-to-deploy-fudmodule-rootkit-and-steal-cryptocurrency-1tbd8cs3o","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,crypto,google-chrome","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"North Korean Hackers Exploit Chrome Zero-Day to Deploy FudModule Rootkit and Steal Cryptocurrency"}]} ```