Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Threat Brief: Understanding Kernel APC Attacks

Summary: Unit 42 reports that the WanaCrypt0r/WannaCry and Petya/NotPetya attacks used a relatively new and little-known technique called kernel APC attacks, in which code that already holds kernel privileges redirects Asynchronous Procedure Calls so legitimate programs execute malicious code in place of their own. The technique leaves none of the usual post-attack fingerprints and, because the commands come from legitimate programs, is harder to detect and prevent without risking unintended consequences.

Key Takeaway: Kernel APC attacks were a contributing factor in WanaCrypt0r/WannaCry and Petya/NotPetya and have drawn little notice outside specialized research circles, which Unit 42 notes makes them inviting to copycat attackers.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related