Inside Citrine Sleet’s Zero-Day Chain: Chrome V8 to Kernel Rootkit

State-sponsored cyber operatives have escalated offensive tradecraft by chaining a high-severity Google Chrome zero-day vulnerability with a Windows kernel privilege escalation flaw, deploying a stealthy data-only rootkit entirely in memory to compromise high-value financial targets.

On August 19, 2024, security researchers detected active exploitation of a zero-day flaw in Google Chrome’s V8 JavaScript engine (CVE-2024-7971) attributed to the North Korean threat actor Citrine Sleet (also tracked as UNC4736, AppleJeus, and DEV-0139). The sophisticated attack weaponized a multi-stage exploit pipeline designed to bypass browser sandbox containment, evade modern endpoint detection and response (EDR) platforms, and gain unrestricted control over target hosts.

[[image:poster]]

B
CVE-2024-7971: V8 Type Confusion
Heap Read / Write
In-Memory Shellcode Execution
CVE-2024-38106: Worker Factory Race Condition
NT AUTHORITY/SYSTEM Privilege
In-Memory FudModule 2.0
Zero ETW System Loggers & Security GUIDs
Unlink Process / Thread / Image Callbacks
Unlink FS Minifilters: 320000-389999
Suspend EDR Agent Processes
Lure Domain: voyagorclub.space] -->|Victim Browses Landing Page| B[Renderer Exploitation

Targeting Web3 Developers: The Citrine Sleet Campaign

Citrine Sleet operates as a specialized offensive cyber unit within North Korea’s Reconnaissance General Bureau, focusing on cryptocurrency theft and financial asset exfiltration to fund state programs.

In this campaign, the group targeted decentralized finance (DeFi) software engineers, cryptocurrency exchanges, and financial technology personnel. Operatives established fraudulent domain infrastructure mimicking legitimate financial platforms, including voyagorclub[.]space and weinsteinfrog[.]com.

Victims were directed to these malicious domains via social engineering campaigns conducted across professional networking platforms and developer channels under the guise of recruitment proposals, project collaborations, or code reviews. The exploit delivered its initial browser payload instantly upon page load, requiring no additional user interaction.

Dissecting CVE-2024-7971: V8 Engine Type Confusion

The attack chain initiated via CVE-2024-7971, a high-severity type confusion vulnerability (classified under CWE-843) situated in Google Chrome’s V8 JavaScript and WebAssembly engine. This marked the third in-the-wild V8 type-confusion zero-day patched in 2024, following CVE-2024-4947 and CVE-2024-5274.

The vulnerability stems from flawed JIT compilation optimization within Liftoff and TurboFan. When optimizing function execution loops, the compiler assumes fixed object layouts (Maps). By mutating object properties during optimization passes without triggering dynamic de-optimization, the exploit causes the engine to treat raw floating-point arrays (PACKED_DOUBLE_ELEMENTS) as object pointer arrays (PACKED_ELEMENTS).

This confusion provides two foundational exploit primitives:

• addrof: Leaks the absolute memory address of any supplied JavaScript object.
• fakeobj: Coerces an arbitrary memory address into a valid JavaScript object reference.

Using these primitives, the exploit constructs a synthetic ArrayBuffer whose backing_store pointer targets arbitrary locations within the renderer address space. To bypass Write XOR Execute (W^X) protections and the V8 Heap Sandbox, the shellcode targets WebAssembly JIT memory pages (historically mapped as Read-Write-Execute) or alters internal function dispatch pointers to execute arbitrary shellcode directly in memory.

Breaking the Sandbox: Chaining CVE-2024-38106 for SYSTEM Elevation

Executing shellcode inside the renderer does not grant full host access. Chromium confines renderer processes within a restricted AppContainer / Low Integrity sandbox where filesystem writes, registry modifications, Win32k system calls, and raw network socket creation are blocked.

To escape containment, Citrine Sleet chained CVE-2024-38106, a Windows NT Kernel (ntoskrnl.exe) race condition flaw with a CVSS score of 7.8 (High).

The exploit invoked raw system calls directly from memory, targeting the kernel’s Worker Factory object management mechanisms within NtSetInformationWorkerFactory. By executing competing worker threads alongside asynchronous state modifications, the exploit won a critical timing window that triggered a use-after-free state in kernel memory.

With an unrestricted kernel read/write primitive established, the exploit traversed the kernel's active process list (ActiveProcessLinks) from its own _EPROCESS structure to locate the _EPROCESS block for the System process (PID 4). It then copied the Token reference (_EX_FAST_REF) from System into its own process structure, instantly elevating the browser process token to NT AUTHORITY\SYSTEM.

In-Memory FudModule 2.0: EDR Blinding via DKOM

Rather than writing binaries to disk or loading unsigned kernel drivers (.sys)—which would trigger Driver Signature Enforcement (DSE) or Hypervisor-Protected Code Integrity (HVCI)—Citrine Sleet deployed FudModule 2.0.

FudModule functions as a data-only rootkit executing entirely in user mode while using its kernel read/write primitive to perform Direct Kernel Object Manipulation (DKOM).

Core DKOM Evasion Capabilities

Detection Engineering & Threat Hunting

Because FudModule strips kernel telemetry post-exploitation, defenders must focus on early-stage browser anomalies, renderer crash signatures, and network IOCs.

Core Detection Principle: Browser renderer processes must never spawn administrative subprocesses or elevate security tokens to SYSTEM integrity.

Threat Hunting via KQL

// Identify Suspicious Token Elevation or Child Processes from Browser Renderers
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "brave.exe")
| where InitiatingProcessCommandLine has "--type=renderer"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "whoami.exe")
 or ProcessIntegrityLevel in ("High", "System")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, ProcessIntegrityLevel

Sigma Detection Rule

title: Browser Renderer Privilege Escalation to SYSTEM
id: c71e1944-93ab-4e2e-8121-5a54dfb82a12
status: experimental
description: Detects browser renderer processes running under or spawning child processes with NT AUTHORITY\SYSTEM integrity
logsource:
 category: process_creation
 product: windows
detection:
 selection:
 ParentImage|endswith:
 - '\chrome.exe'
 - '\msedge.exe'
 - '\brave.exe'
 ParentCommandLine|contains:
 - '--type=renderer'
 User|contains:
 - 'AUTHORITY\SYSTEM'
 condition: selection
level: critical
tags:
 - attack.execution
 - attack.privilege_escalation
 - attack.t1055
 - attack.t1068

Indicators of Compromise (IOCs)

Enterprise Fleet Remediation & Hardening Guide

Neutralizing browser-to-kernel zero-day chains requires eliminating browser patch application delays, maintaining operating system update baselines, and enforcing hardware-backed virtualization security.

• Browser Patch Verification: Ensure all endpoints run Google Chrome 128.0.6613.84, Microsoft Edge 128.0.2739.42, or later releases.
• Enforce Mandatory Browser Relaunch Policies: Configure enterprise policies (RelaunchNotification = 2 and RelaunchNotificationPeriod = 86400000 ms) in SOFTWARE\Policies\Google\Chrome and SOFTWARE\Policies\Microsoft\Edge to force browser restarts within 24 hours of an update download.
• Deploy OS Security Updates: Install Windows cumulative updates KB5041580 (Windows 11) or KB5041585 (Windows 10) to remediate the CVE-2024-38106 kernel race condition.
• Enable Virtualization-Based Security (VBS) & HVCI: Hardware-enforced Hypervisor-Protected Code Integrity restricts kernel code injection and protects control flow integrity.
• Enforce Microsoft Vulnerable Driver Blocklist: Maintain updated Windows Defender Application Control (WDAC) policies to block Bring Your Own Vulnerable Driver (BYOVD) fallback attempts.