BYOVD, or Bring Your Own Vulnerable Driver, is a Windows attack technique in which an attacker installs an exploitable driver to move from administrative access into kernel mode. Lazarus used known vulnerable drivers, including a Dell driver affected by CVE-2021-21551, to enable versions of the FudModule data-only rootkit. Kernel access let FudModule manipulate kernel structures, impair Event Tracing for Windows telemetry, and bypass or disable security technology. Later activity replaced BYOVD with exploitation of CVE-2024-21338 in the built-in AppLocker driver for greater stealth.