Lazarus_Group__2022__Analysis-Report-on-Lazarus-Groups-Rootkit-Attack-Using-BYOVD_Sep-22-2022.pdf

### Executive Summary: AhnLab's report analyzes a Lazarus Group APT that deployed a BYOVD rootkit which abuses a signed vulnerable driver (ene.sys / WinIO) to map physical memory, compute kernel DTB, convert virtual to physical addresses, and flip ETHREAD.PreviousMode to enable ZwWriteVirtualMemory from userland; the rootkit then disables file filters, process/thread/module callbacks, registry/object callbacks, WFP filters, and ETW to neutralize endpoint security across multiple Windows versions, and the report provides IoCs (file paths, MD5s) and mitigation guidance.