North Korea’s Lazarus Group has been caught exploiting a newly patched Windows zero-day to gain SYSTEM-level access and deploy backdoor malware against defense and aerospace companies in France, Germany, Brazil, and India. The attacks are part of Operation Dream Job, a long-running cyber espionage campaign that relies on fake job offers and trojanized software to infiltrate some of the most security-conscious organizations in the world.
CVE-2026-68820: The Windows AFD.sys Zero-Day Behind the Attacks
What is CVE-2026-68820? CVE-2026-68820, rated 7.0 on the CVSS scale, is a privilege escalation vulnerability in Windows Ancillary Function Driver for WinSock, commonly known as AFD.sys. It allows an attacker with an initial foothold on a compromised machine to elevate privileges to SYSTEM, the highest level of access in the Windows security model. Microsoft addressed the flaw in its Patch Tuesday updates for August 2026.
AFD.sys is a kernel-mode driver that underpins Winsock, the Windows networking API used by countless applications for TCP/IP communication. Because it is deeply embedded in the operating system and frequently loaded during normal system activity, AFD.sys represents an attractive target for threat actors seeking to move from low-level code execution to complete system compromise. For Lazarus, this vulnerability became the pivot point that transformed a phony job offer into a full-scale intrusion.
Researchers at Check Point Research reported the vulnerability to Microsoft in late July 2026. However, evidence suggests the group had weaponized the flaw much earlier, with a successful implementation observed in early June. That gap between in-the-wild exploitation and vendor patching is exactly the kind of window that sophisticated state-sponsored attackers exploit. By the time the security community knew the vulnerability’s name, Lazarus had already used it to gain SYSTEM privileges on multiple high-value targets.
The exploitation is particularly dangerous because AFD.sys operates at the kernel level. Once an attacker achieves SYSTEM access, they can disable security controls, tamper with code-integrity policies, load kernel driver components, and hide malicious activity from endpoint detection software. In the latest campaign, Lazarus used the flaw to inject a second-stage payload into a SYSTEM process, ensuring that its backdoors continued to run quietly and with elevated privileges.
Operation Dream Job: Fake Recruiters, Phony Offers, and Real Malware
These attacks are not an isolated technical event. They are the latest chapter in Operation Dream Job, a long-running espionage and social engineering campaign conducted by Pyongyang-backed hackers. Known for targeting professionals with convincing but fake job opportunities, the campaign has repeatedly impersonated recruiters on LinkedIn and other professional platforms to build trust with employees in defense, aerospace, nuclear energy, and other sensitive sectors.
This time, the lure revolves around companies such as Lockheed Martin and Enveil. Victims are approached with recruiter-style messages, invited to apply for positions, and eventually directed to open a malicious PDF or install a trojanized PDF viewer. The goal, as in previous waves, is to steal sensitive data and install malware that can survive for months inside a target network.
The latest wave uses a tactic that Lazarus has refined since at least 2022: weaponizing document viewers and side-loading chains. Two parallel infection sequences were observed in active attacks, each designed to follow a slightly different path but converge on the same objective: full remote control of the victim’s machine.
DLL Side-Loading: A Familiar but Effective Trick
The first infection chain begins when victims are instructed to download an encrypted archive. That archive triggers a DLL side-loading sequence, a technique in which a legitimate executable is manipulated into loading a malicious DLL from the same directory. In this case, the weaponized file is libmupdf.dll, and it appears to have been repurposed to display a believable job description to the victim while quietly performing its real work behind the scenes.
Once loaded, libmupdf.dll downloads and executes a lightweight downloader called MISTPEN directly in memory. MISTPEN communicates with attacker-controlled infrastructure using Microsoft Graph API and OneDrive, which allows the malware to blend in with normal Office and cloud traffic. It also retrieves additional modules, triggers the AFD.sys exploit, and ultimately deploys ForestTiger, also known as ScoringMathTea. ForestTiger provides remote access to the host, giving the attackers a persistent presence in the network.
Trojanized SecurityPDF Viewer Delivers Troy Backdoor
The second infection chain is built around a fraudulent piece of software called SecurityPDF. Victims are directed to websites that impersonate Enveil, the very company the fake recruiters claim to represent, and are encouraged to download a PDF viewer that appears to be a legitimate tool. In reality, the application is a trojanized viewer designed to wait for a specific trigger from the attacker.
That trigger is an unusual marker embedded in a PDF file: “This document is encrypted with sumatrapdf reader!!!!!!!!!!!!”. When the victim opens a PDF containing this marker through the trojanized viewer, the application decrypts and launches an embedded payload that loads a previously unseen backdoor called Troy directly into memory.
Troy is a DLL-based implant with a wide range of operational capabilities. It supports 17 operator commands that can be used to enumerate files, upload and download data, create archives for exfiltration, open an interactive shell, terminate processes, inject DLLs into running processes, and update its own configuration. By operating entirely in memory, Troy reduces its forensic footprint and makes traditional file-based detection far less likely to succeed.
The attackers created at least three websites to distribute SecurityPDF:
- envell[.]xyz
- enveil[.]online
- uxtramine[.]org
The likely delivery sequence involves sending a PDF through a phishing message first, then instructing the victim to download SecurityPDF from one of these sites in order to view it. The ruse is effective because the fake sites are designed to rank highly in search engine results, and they carry the same branding that a target would expect from a real software portal.
From Initial Access to SYSTEM: How the AFD.sys Exploit Is Weaponized
Both infection chains eventually lead to the same privilege escalation routine. MISTPEN, which plays a central role in the DLL side-loading chain, loads at least four distinct modules as part of the post-compromise process.
- GetInfoPlugin (Release_GetInfoPlugin_x64.dll): profiles the host and exfiltrates the collected information as a single wide-character string, giving the attackers a quick picture of the compromised environment.
- PvPlugin (Release_PvPlugin_x64.dll): gathers additional host reconnaissance data and details about running processes, helping the group identify high-value systems and security tools.
- OneScreenCapture (OneScreenCapture64.dll): takes screenshots of the current desktop, including all connected monitors, and sends them to the attackers as JPEG images. This can expose sensitive documents, credentials, and internal workflows while the user is actively working.
- LPE loader: collects host information, generates new key material using the ML-KEM post-quantum key encapsulation algorithm, and uses the negotiated key during the handshake process to decrypt and run FudModule.
The inclusion of ML-KEM is a notable development. Post-quantum cryptography is typically associated with future-proofing communications, but here it is used to make the malware’s own handshake more resilient to decryption and analysis. It suggests that Lazarus is thinking ahead about how to protect its attack chain from both current security controls and future capabilities that might be used to intercept or replay malicious traffic.
FudModule itself is not new. Lazarus has repeatedly used this kernel-mode rootkit since at least 2022 to conceal malicious tools from security software running on the host. What is new is the version: FudModule 3.1 introduces an improved technique for tampering with Smart App Control, a Windows security feature designed to verify whether a program is safe to run based on reputation and code integrity.
Within a SYSTEM-level msiexec.exe child process, the malware’s remote stub sets VerifiedAndReputablePolicyState to zero and invokes NtSetSystemInformation class 0xA4 with option 0x10000000. This triggers an in-place reload of the code integrity policy. In effect, the rootkit disables one of the operating system’s newer guardrails and then forces the system to apply the updated policy immediately, without requiring a reboot.
With Smart App Control neutralized, the attackers can run arbitrary code on the compromised machine without triggering the same level of scrutiny from the operating system. Combined with AFD.sys exploitation, this creates a surprisingly clean path from an initial phishing click to deep, stealthy control of a defense or aerospace network.
Hiding in Plain Sight: Compromised WordPress, SharePoint, and Roundcube Servers
One of the most troubling aspects of this campaign is the infrastructure behind it. Rather than spinning up dedicated command-and-control servers that security teams could easily block, Lazarus hijacked legitimate infrastructure that was already operational and trusted. The group used compromised WordPress and SharePoint sites, as well as vulnerable Roundcube webmail servers, to host ForestTiger C2 communications.
This approach makes malicious traffic far harder to distinguish from normal web activity. A security analyst investigating a connection to a hacked university webmail server or a small business’s WordPress site sees traffic that looks ordinary. Only after careful inspection does it become clear that the server is being used to relay commands and stolen data.
Many of the Roundcube servers targeted in the campaign were vulnerable to CVE-2025-49113. Attackers exploited this flaw to install a previously undocumented PHP web shell known as RelayShell, which enables the exchange of commands and responses in the form of text files. The web shell can be used to stage files, move data, and maintain access even if the original infection vector is discovered and cleaned.
In at least one case, an already breached organization based in France was used to send phishing messages to new victims. Because the emails originated from a previously compromised but still credible domain, they were more likely to bypass reputation-based filters and arrive in the inbox. This is a powerful reminder that attackers are not just spoofing identities; they are borrowing real reputations from organizations that have already been quietly compromised.
Why This Campaign Changes the Phishing Equation
There is no shortage of phishing campaigns in the world, but the Lazarus Group continues to stand out because of the depth of its operational preparation. The use of a zero-day vulnerability is significant on its own, but the surrounding campaign is what makes it truly dangerous. Every stage of the attack is wrapped in legitimacy: legitimate-looking job posts, legitimate-looking software downloads, legitimate-looking domains, and legitimate infrastructure that has been subverted from behind the scenes.
Sergey Shykevich, director of threat intelligence at Check Point Software, offered a blunt assessment of the campaign’s sophistication. “What makes this campaign so dangerous is not only the zero-day vulnerability – but also how Lazarus wove legitimate, trusted infrastructure into every stage of the attack,” he said. “They hid in plain sight, behind top-ranked search results, real vendor branding, and the reputation of organizations they had already compromised. When the website, the download and the recruiter all appear authentic, the old advice to ‘spot the phishing link’ is no longer easily applicable. Staying safe now means assuming that trust itself can be counterfeited: patch the moment updates land, verify software through official channels rather than search rankings, and extend zero-trust thinking to the legitimate-looking sites and partners we interact with every day.”
For defenders, the practical implications are significant. Organizations operating in defense, aerospace, and other critical sectors should treat unsolicited recruiter messages with the same suspicion as unexpected attachments. Software downloads should be verified through official vendor channels, not through search engine results or links sent directly in messages. Patching should be treated as a time-critical function, especially when Microsoft publishes updates for publicly disclosed zero-days.
At the same time, security teams should consider that the next intrusion may not begin with an obviously malicious file. It may begin with a believable conversation, a clean-looking website, and a piece of software that appears to have been recommended by a trusted company. The Lazarus Group’s latest campaign is a clear reminder that in modern cyber espionage, the most convincing attacks are often the ones that look completely legitimate.
