Lazarus hackers pair fake job offers with Windows zero-day exploit
Lazarus' Operation Dream Job targets the defense sector with fake job offers, a Windows LPE zero-day (CVE-2026-68820), and new Troy and RelayShell backdoors.
Check Point documented two parallel infection chains in Lazarus' Operation Dream Job: a digitally signed PDF viewer with DLL sideloading delivering the MISTPEN in-memory downloader, and a trojanized SecurityPDF viewer, distributed via fake Enveil websites, installing the newly documented Troy backdoor. A component exploits CVE-2026-68820, a local privilege escalation zero-day in the Windows AFD.sys driver used since at least early July, which Microsoft patched on August 11, 2026, enabling deployment of the FudModule kernel-mode rootkit. Lazarus also compromised Roundcube webmail servers vulnerable to CVE-2025-49113 to deploy the RelayShell PHP web shell and relay C2 traffic, targeting defense-sector organizations primarily in Western Europe and India. Separately, CERT-UA documented Sandworm's UAC-0145 using fake job offers against IT professionals since May 2026.
- Operation Dream Job targets defense-sector organizations in Western Europe and India with job offers, one decoy imitating Lockheed Martin.
- CVE-2026-68820 is a Windows AFD.sys LPE zero-day, exploited since early July and patched by Microsoft on August 11, 2026.
- New Troy backdoor and RelayShell PHP web shell expand Lazarus tooling; FudModule rootkit deployed after SYSTEM escalation.
- Compromised Roundcube servers (CVE-2025-49113) relay C2 traffic; Enveil-impersonating websites distribute trojanized SecurityPDF.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 Malicious FileT1574.002 DLL Side-LoadingT1068 Exploitation for Privilege EscalationT1620 Reflective Code Loading
- Products
- WindowsRoundcubeSecurityPDF
- Threat actors
- LazarusSandwormAPT44Seashell BlizzardUAC-0145
- Organizations
- Check PointMicrosoftESETCERT-UALockheed MartinEnveil
- Countries
- North KoreaRussiaUkraine
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-49113 | Authenticated PHP Object Deserialization RCE in Roundcube Webmail | 8.8 | 99% | KEVPoC ×2 | KEV |
| CVE-2026-68820 | Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver | 7.0 | <1% | KEV | KEV |
From the original article
3 min read at helpnetsecurity.com
The North Korea-linked Lazarus group is using fake job offers, trojanized PDF software and a Windows zero-day in attacks aimed primarily at the defense sector, Check Point researchers have found. The activity is part of Operation Dream Job, a long-running campaign in which attackers pose as recruiters and lure targets with job opportunities at well-known companies.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.