60
60
North Korean Lazarus Group Uses Windows Zero
Check Point links Lazarus Group's Operation Dream Job to a new Windows zero-day, CVE-2026-68820, targeting defense workers with fake Lockheed Martin job offers.
Check Point Research documented a new wave of Operation Dream Job, a North Korean Lazarus Group campaign targeting defense and aerospace professionals in France, Germany, Brazil, and India with fake Lockheed Martin job offers. The attacks chain a previously unknown Windows privilege escalation flaw in AFD.sys, CVE-2026-68820, which Microsoft patched on August 11, 2026, to deploy the MISTPEN downloader, ForestTiger backdoor, and updated FudModule 3.1 kernel rootkit. Check Point also discovered a new Troy backdoor DLL with 17 operator commands and a RelayShell PHP webshell deployed on compromised Roundcube and WordPress servers used as command relays, some infected via CVE-2025-49113 or leaked credentials. Defenders are urged to apply the August 2026 Patch Tuesday update and review Check Point's indicators of compromise.
84
Week in review: New Black Basta's social engineering campaign, passing the CISSP exam in 6 weeks
60
60
60
60
60
60
Week in review: 2 threat actors exploiting WinRAR 0-day, Microsoft fixes “BadSuccessor” Kerberos flaw
60
Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
Lazarus exploits Windows AFD.sys zero-day CVE-2026-68820 in Operation Dream Job to deploy Troy backdoor at defense firms.
Check Point attributes Operation Dream Job attacks to Lazarus Group exploiting CVE-2026-68820 (CVSS 7.0), a privilege escalation flaw in Windows AFD.sys patched in August 2026 Patch Tuesday. The campaign targets defense and aerospace firms in France, Germany, Brazil, and India via trojanized PDF viewers and DLL side-loading, deploying backdoors Troy, ForestTiger, and the FudModule 3.1 kernel rootkit. Attackers also compromise WordPress, SharePoint, and Roundcube servers as C2, using CVE-2025-49113 and the RelayShell PHP web shell.
78
Lazarus hackers pair fake job offers with Windows zero-day exploit
Lazarus' Operation Dream Job targets the defense sector with fake job offers, a Windows LPE zero-day (CVE-2026-68820), and new Troy and RelayShell backdoors.
Check Point documented two parallel infection chains in Lazarus' Operation Dream Job: a digitally signed PDF viewer with DLL sideloading delivering the MISTPEN in-memory downloader, and a trojanized SecurityPDF viewer, distributed via fake Enveil websites, installing the newly documented Troy backdoor. A component exploits CVE-2026-68820, a local privilege escalation zero-day in the Windows AFD.sys driver used since at least early July, which Microsoft patched on August 11, 2026, enabling deployment of the FudModule kernel-mode rootkit. Lazarus also compromised Roundcube webmail servers vulnerable to CVE-2025-49113 to deploy the RelayShell PHP web shell and relay C2 traffic, targeting defense-sector organizations primarily in Western Europe and India. Separately, CERT-UA documented Sandworm's UAC-0145 using fake job offers against IT professionals since May 2026.
82
Microsoft pins on-prem SharePoint attacks on Chinese threat actors
60
60
60
60
60
60
60
60
60
Chinese espionage groups swarm to exploit triple-link chain of zero-days
Four China-aligned espionage groups, starting with TA412/APT31, chained zero-days CVE-2026-85046, CVE-2026-87491 and CVE-2026-85880 to spy on targets since late August.
TA412 (Violet Typhoon/APT31) began exploiting the BlueMoon chain on Aug. 28, followed by UNK_LateNight (US aerospace, Sept. 2), UNK_DoubleCheck (Vietnamese manufacturing via a compromised Southeast Asian government account) and UNK_QuietRacket (Indonesia and Singapore government, consulting and finance, Sept. 3). The chain pairs Chromium JavaScript engine RCE flaws CVE-2026-85046 and CVE-2026-87491 with the Windows ALPC privilege-escalation zero-day CVE-2026-85880, enabling sandbox escape and system privileges. Delivery used phishing links installing a fake Google Gemini browser extension that surveilled browser activity and stole credentials; Proofpoint directly observed fewer than 20 organizations but expects wider proliferation as the kit spreads.
85
60
60
60
60
60
45
60
60
45
60
60
60
60
60
45
60
60
45