Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
Lazarus exploits Windows AFD.sys zero-day CVE-2026-68820 in Operation Dream Job to deploy Troy backdoor at defense firms.
Check Point attributes Operation Dream Job attacks to Lazarus Group exploiting CVE-2026-68820 (CVSS 7.0), a privilege escalation flaw in Windows AFD.sys patched in August 2026 Patch Tuesday. The campaign targets defense and aerospace firms in France, Germany, Brazil, and India via trojanized PDF viewers and DLL side-loading, deploying backdoors Troy, ForestTiger, and the FudModule 3.1 kernel rootkit. Attackers also compromise WordPress, SharePoint, and Roundcube servers as C2, using CVE-2025-49113 and the RelayShell PHP web shell.
- Windows AFD.sys zero-day CVE-2026-68820 grants SYSTEM privileges
- New Troy backdoor loads via trojanized SecurityPDF viewer
- FudModule 3.1 rootkit tampers with Smart App Control
- MISTPEN downloader uses Microsoft Graph API and OneDrive for C2
- Compromised Roundcube servers with CVE-2025-49113 host RelayShell web shell
- ATT&CK
- T1566.001 Spearphishing AttachmentT1068 Exploitation for Privilege EscalationT1574.002 Hijack Execution Flow: DLL Side-LoadingT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup FolderT1055 Process Injection
- Threat actors
- Lazarus Group
- Organizations
- Check Point Research
- Countries
- FranceGermanyBrazilIndiaNorth Korea
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-49113 | Authenticated PHP Object Deserialization RCE in Roundcube Webmail | 8.8 | 99% | KEVPoC ×2 | KEV |
| CVE-2026-68820 | Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver | 7.0 | <1% | KEV | KEV |
From the original article
5 min read at thehackernews.com
The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security flaw impacting Microsoft Windows to deliver a never-before-seen backdoor targeting defense and aerospace companies across France, Germany, Brazil, and India.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.