North Korean Lazarus Group Uses Windows Zero
Check Point links Lazarus Group's Operation Dream Job to a new Windows zero-day, CVE-2026-68820, targeting defense workers with fake Lockheed Martin job offers.
Check Point Research documented a new wave of Operation Dream Job, a North Korean Lazarus Group campaign targeting defense and aerospace professionals in France, Germany, Brazil, and India with fake Lockheed Martin job offers. The attacks chain a previously unknown Windows privilege escalation flaw in AFD.sys, CVE-2026-68820, which Microsoft patched on August 11, 2026, to deploy the MISTPEN downloader, ForestTiger backdoor, and updated FudModule 3.1 kernel rootkit. Check Point also discovered a new Troy backdoor DLL with 17 operator commands and a RelayShell PHP webshell deployed on compromised Roundcube and WordPress servers used as command relays, some infected via CVE-2025-49113 or leaked credentials. Defenders are urged to apply the August 2026 Patch Tuesday update and review Check Point's indicators of compromise.
- Lazarus used CVE-2026-68820, a privilege escalation flaw in AFD.sys, to gain SYSTEM and evade EDR visibility.
- Two infection chains deliver MISTPEN, ForestTiger, the FudModule 3.1 rootkit, and the new Troy backdoor.
- Troy is a single DLL implant supporting 17 operator commands including shell access and in-memory DLL injection.
- C2 relays run on compromised Roundcube webmail and WordPress sites infected via leaked credentials and CVE-2025-49113.
- Targets confirmed in France, Germany, Brazil, and India; applying the August Patch Tuesday fix is the priority.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 Malicious FileT1574.002 DLL Side-LoadingT1068 Exploitation for Privilege EscalationT1014 Rootkit
- Threat actors
- Lazarus Group
- Countries
- North Korea
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-49113 | Authenticated PHP Object Deserialization RCE in Roundcube Webmail | 8.8 | 99% | KEVPoC ×2 | KEV |
| CVE-2026-68820 | Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver | 7.0 | <1% | KEV | KEV |
From the original article
3 min read at securityaffairs.com
Lazarus targets defense professionals with fake Lockheed Martin jobs, exploiting a Windows zero-day to deploy backdoors and evade security controls. Check Point Research has uncovered a new wave of Operation Dream Job , the long-running North Korean campaign that lures defense and aerospace professionals with convincing fake job offers.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.