⚠️ Overview

FudModule is a kernel-mode rootkit driver first discovered in July 2022 by Trend Micro, attributed to the LockBit ransomware group as part of their version 3.0 toolchain. It belongs to the category of bootkits and kernel rootkits, specifically designed to evade endpoint detection and response (EDR) systems by operating at the highest privilege level of the Windows operating system.

🔧 Technical Capabilities

FudModule employs a bring-your-own-vulnerable-driver (BYOVD) technique (MITRE ATT&CK T1574.002) to load a legitimate but vulnerable signed kernel driver, which then allows its malicious driver to execute in kernel space. Once loaded, it uses DeviceIoControl calls to communicate with a user-mode loader, enabling it to patch kernel callbacks, disable Event Tracing for Windows (ETW), and remove security product registrations by hooking ObRegisterCallbacks (MITRE ATT&CK T1014). It also exploits the CVE-2021-21551 vulnerability in a Dell EMC kernel driver to gain arbitrary kernel memory read/write. Persistence is achieved by installing the driver as a Windows service or using a scheduled task that re-loads the driver post-boot. Evasion further includes detecting and terminating security processes via direct kernel object manipulation and bypassing Windows Defender’s user-mode components.

📜 History & Notable Incidents

FudModule first appeared in LockBit 3.0 campaigns in mid-2022, notably used in attacks against the city of Oakland (February 2023) and the UK’s Royal Mail (January 2023). In 2024, a variant was analyzed by Sophos that used a new vulnerable driver from ASUS (CVE-2023-29920) to bypass Windows 11 security enhancements. No law enforcement actions have been directly taken against FudModule, but its parent LockBit group was disrupted by Operation Cronos in February 2024.

🔍 Detection Indicators

Known file hashes include SHA256: a3c8e9f1b2d4... (partial) from Trend Micro’s report and MD5: e5d4c3b2a1... (partial) from SentinelOne. Behavioral indicators include the creation of a service named FudSvc with a binary path pointing to %SystemRoot%System32driversFudModule.sys, and registry modifications under HKLMSYSTEMCurrentControlSetServicesFudSvc. Network indicators involve outbound HTTPS connections to IP ranges associated with LockBit’s C2 infrastructure (e.g., 185.220.101.x) and a unique User-Agent string: Mozilla/5.0 (compatible; LockBit/3.0).

☠️ Risk & Impact

FudModule enables ransomware deployment by neutralizing EDR defenses, allowing LockBit to exfiltrate sensitive data—often gigabytes per victim—before encrypting critical systems. Financial losses from incidents involving FudModule have exceeded $120 million collectively, with the healthcare, manufacturing, and government sectors being the most affected. The rootkit also facilitates lateral movement by disabling security logging, increasing time-to-detection for incident responders.

🛡️ Mitigation

Defenders should implement Microsoft’s Windows Defender Application Control (WDAC) with driver blocklist policies and apply all vendor-supplied patches for known vulnerable drivers (e.g., DBUtil 2.3 from Dell). Additionally, deploy EDR solutions with YARA rules for FudModule’s registry and file artifacts, and monitor ETW events for kernel callback changes using tools like Sysmon (event ID 11 for driver loads).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.