Malware

FudModule

Also known as: LIGHTSHOW

FudModule is a user-mode DLL that gets the ability to read and write arbitrary kernel memory via the BYOVD technique. Its main goal is to turn off Windows system monitoring features, which is done by modifying kernel variables and removing kernel callbacks. Its actions may very likely affect various types of security products, e.g. EDRs, firewalls, antimalware and even digital forensics tools.

MITRE ATT&CK TTPs 3

T1055
Process Injection
Defense Evasion
 T1068
Exploitation for Privilege Escalation
Privilege Escalation
 T1078
Valid Accounts
Defense Evasion

Source Articles

Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days
Microsoft's August 2026 Patch Tuesday addresses 400 vulnerabilities, including three zero-days. One of these, CVE-2026-68820, was actively exploited in the wild by the North Korean threat actor Lazarus Group to elevate privileges and deploy a kernel-mode rootkit called FudModule. The other two zero-days, CVE-2026-62832 and CVE-2026-72971, were publicly disclosed but not confirmed as exploited. Check Point linked the exploitation of CVE-2026-68820 to Lazarus, highlighting ongoing targeting using local privilege escalation in Windows drivers.
bleeping-computer ·2h ago