Lazarus exploits Windows zero-day in defence attacks

North Korea-linked hackers exploited a previously unknown Windows vulnerability to gain the highest level of system privileges while targeting defence, aerospace and aviation organisations across several countries.

The flaw, tracked as CVE-2026-68820, affects the Windows Ancillary Function Driver for WinSock, known as AFD. sys. Microsoft patched the vulnerability on August 11 after it was found being actively exploited as part of the long-running Operation Dream Job cyber-espionage campaign associated with the Lazarus Group.

Attack activity was confirmed against organisations in France, Germany, Brazil and India, with the campaign placing particular emphasis on companies connected to military technology, aviation, surveillance systems, drones and robotics. Evidence indicates the vulnerability had been exploited since at least early July, rather than for approximately two months as some initial descriptions of the campaign suggested.

CVE-2026-68820 is a use-after-free vulnerability caused by a race condition in AFD. sys, a kernel component responsible for handling Windows network sockets. An attacker who already has code running on a targeted computer can exploit the weakness to elevate privileges to SYSTEM, effectively gaining control over the machine.

Microsoft classified the flaw as important and assigned it a CVSS severity score of 7.0. It was the only vulnerability in the August security release confirmed as being actively exploited when patches were issued. The security update covered hundreds of vulnerabilities across Windows, Office, SharePoint Server, Exchange Server and other Microsoft products.

The Lazarus operation combined the privilege-escalation flaw with social engineering techniques that have become a signature of Operation Dream Job. Attackers posed as recruiters and presented employees of sensitive organisations with apparently attractive job opportunities at prominent companies.

One observed lure used a job description resembling an offer from Lockheed Martin. Another campaign impersonated privacy-enhancing technology company Enveil. There is no indication that Enveil itself was compromised.

Victims were directed towards malicious files or software presented as legitimate tools for viewing job-related PDF documents. One infection chain used a digitally signed PDF viewer alongside a malicious DLL and encrypted payload. The rogue DLL was loaded through DLL sideloading while the victim saw an apparently genuine document.

A later infection chain identified in July used SecurityPDF, a modified application based on the legitimate open-source MuPDF framework. Attackers created at least three websites impersonating Enveil to distribute the trojanised viewer, with some gaining prominent placement in search results.

SecurityPDF was engineered to recognise specially prepared files masquerading as ordinary PDFs. Opening one caused an encrypted executable payload to be extracted and launched, ultimately loading a previously undocumented backdoor named Troy.

Troy provides attackers with extensive control of an infected computer. The 64-bit malware supports 17 commands covering system reconnaissance, process management, file uploads and downloads, command execution and injection of additional code into running processes. It can also compress directories and exfiltrate their contents.

The attackers used another Lazarus tool, MISTPEN, as an in-memory downloader. Its communications can pass through Microsoft Graph and OneDrive, enabling malicious activity to blend with network traffic generated by legitimate Microsoft services.

CVE-2026-68820 was incorporated into an updated version of the FudModule kernel rootkit. Exploiting the vulnerability allows FudModule to operate with SYSTEM privileges and interfere with security monitoring. The version analysed during the campaign targeted newer Windows builds and contained functionality capable of tampering with Windows Smart App Control.

The rootkit can suppress security products and remove or interfere with several Windows mechanisms that endpoint detection tools depend upon. Its ability to reduce visibility after obtaining kernel-level access makes the initial privilege-escalation vulnerability particularly valuable in espionage operations.

Lazarus also sought to make its command-and-control infrastructure harder to identify by exploiting legitimate servers belonging to third parties. Earlier ForestTiger infrastructure linked with the operation relied heavily on compromised WordPress and SharePoint servers.

The attackers have increasingly incorporated compromised Roundcube webmail systems. Vulnerable servers were infected with a previously undocumented PHP web shell named RelayShell, which acts as an intermediary between compromised computers and attacker-controlled infrastructure.