The latest Lazarus Group campaign demonstrates why organizations should not evaluate zero-day vulnerabilities in isolation from the attack chain surrounding them. In the attacks uncovered by Check Point Research, the North Korea-linked threat actor did not use the Windows vulnerability to compromise arbitrary machines directly from the internet. Instead, victims were first drawn into the long-running Operation Dream Job campaign through convincing employment opportunities aimed largely at professionals working in defense, aerospace and aviation. Once malicious software was running on the victim’s computer, Lazarus exploited CVE-2026-68820 in the Windows Ancillary Function Driver for WinSock to escalate privileges to SYSTEM, deploy an updated FudModule kernel rootkit and weaken endpoint-security visibility. The combination is far more dangerous than either technique alone: social engineering provides the foothold, while the zero-day converts that foothold into privileged control. 

CVE-2026-68820 is a local privilege-escalation vulnerability in `AFD.sys`, a Windows kernel driver responsible for important socket and networking functionality. Check Point’s analysis indicates that the flaw is a race-condition use-after-free issue. Under carefully controlled concurrent access, one code path can continue using memory after another code path has released it, allowing the exploit to manipulate kernel memory and eventually create the read-and-write capability required to obtain SYSTEM privileges. Microsoft assigned the vulnerability a CVSS score of 7.0, but its operational value to an advanced attacker is much greater than that score alone may suggest because successful exploitation occurs after the attacker already has code execution on a carefully selected target.

This is an important vulnerability-management lesson. A local privilege-escalation flaw may appear less urgent than an unauthenticated remote-code-execution vulnerability because the attacker must already have access to the system. Real intrusions, however, are composed of stages. Initial malware often executes with ordinary user privileges, while modern operating systems and endpoint-security tools deliberately restrict what those processes can do. A reliable kernel exploit lets the attacker cross that boundary, gain SYSTEM authority and interfere with the defensive controls designed to detect the rest of the intrusion.

Check Point says the exploit had been used in the wild since at least early July 2026 against fully patched Windows 11 systems before Microsoft released the fix on August 11. The exploit specifically checked for newer Windows builds, including Windows 11 24H2 and 25H2, demonstrating that attackers were not simply relying on organizations running obsolete operating systems. Even environments that maintained normal patch compliance remained exposed because no security update existed during the zero-day period.

This reinforces why patching, although essential, cannot be the only defensive assumption. Organizations need controls capable of detecting suspicious activity before the vulnerability becomes publicly known. A malicious PDF viewer executing unexpected payloads, a legitimate application loading an unusual DLL, in-memory modules performing reconnaissance, or a user process attempting to manipulate kernel components should all provide opportunities for detection before privilege escalation succeeds.

Lazarus used two parallel infection chains in the campaign. In one, victims received an encrypted archive containing a legitimate digitally signed PDF viewer, a malicious `libmupdf.dll` used for DLL sideloading and an encrypted payload masquerading as a PDF. Launching the legitimate viewer caused Windows to load the attacker-controlled DLL from the same directory. The malicious component displayed a convincing job description to the victim while silently loading MISTPEN, an in-memory downloader used to continue the intrusion.

DLL sideloading remains effective precisely because the visible executable can be completely legitimate and digitally signed. The problem is not necessarily the executable itself but which libraries Windows allows it to load. Application-control systems should therefore evaluate the complete execution chain rather than treating a trusted signature as proof that everything happening inside the process is legitimate.

The second infection chain used a trojanized PDF reader called SecurityPDF. Victims were presented with fraudulent employment opportunities impersonating the legitimate security company Enveil and directed toward websites created by the attackers. The modified viewer inspected PDF files for a specific marker and, when it found one, decrypted and executed an embedded payload containing a previously undocumented backdoor that Check Point named Troy.

This technique exploits a particularly effective psychological assumption: if a document does not open correctly, the user often searches for or accepts a different application capable of opening it. Lazarus turned that troubleshooting behaviour into an infection mechanism. The victim believes the special viewer is required to read a protected job document, while the viewer exists primarily to recognize the attacker’s crafted PDF and launch malware.

Check Point found at least three websites impersonating Enveil, and some ranked highly in search results for relevant queries. This introduces another increasingly important threat: search-engine ranking can create perceived legitimacy. Users have been trained to avoid suspicious links in unsolicited email, but an attacker who persuades the victim to search independently for software may still control what the victim finds.

Search ranking is therefore not a security control. Employees downloading sensitive software should verify the vendor domain independently and use official application stores, enterprise repositories or publisher-provided cryptographic signatures where available. The fact that a website appears near the top of a search engine does not establish that the organization whose branding appears on it operates the site.

Once MISTPEN is running, Lazarus performs reconnaissance before deciding whether to proceed. Modules collect host, domain and operating-system information, enumerate processes and capture screenshots. This deliberate target validation reflects the espionage nature of the operation. The attacker does not necessarily deploy every capability against every machine; the compromised endpoint is evaluated first to determine whether it belongs to a sufficiently valuable target.

Organizations can use this behaviour defensively. Unusual process enumeration, screen capture and system profiling immediately after execution of a newly downloaded application can provide early warning before the privilege-escalation stage. EDR platforms should correlate these actions as part of an intrusion sequence rather than treating each one as an isolated low-severity event.

After a suitable victim is identified, MISTPEN retrieves the privilege-escalation module containing the CVE-2026-68820 exploit. Successful exploitation launches FudModule with SYSTEM privileges and injects another instance of MISTPEN into a SYSTEM process. The malware can therefore continue operating with substantially higher privileges while becoming more difficult for ordinary user-level security controls to observe.

FudModule is particularly significant because Lazarus has developed the rootkit over several years specifically to attack security monitoring. The latest version retains mechanisms for interfering with process, thread, image, registry and filesystem callbacks used by defensive products, suppressing crash dumps and disrupting Event Tracing for Windows and other telemetry sources. Its purpose is not merely obtaining privilege but using that privilege to blind the systems responsible for detecting subsequent activity.

The newest FudModule version also includes functionality for tampering with Windows Smart App Control. Once operating with SYSTEM privileges, it changes the policy state and triggers a reload of the code-integrity policy. This is another useful reminder that preventive operating-system protections depend upon the integrity of the privileged layers beneath them. If attackers obtain kernel-level authority, they may be able to manipulate the very mechanisms intended to decide which software is trustworthy.

Endpoint-security architecture should therefore assume that sufficiently privileged attackers will attempt to disable monitoring. Telemetry should be forwarded rapidly to centralized systems so historical evidence does not depend entirely upon the continued integrity of the compromised endpoint. Network, identity, cloud and authentication logs can also provide independent signals even when local EDR visibility is impaired.

The campaign’s use of Microsoft Graph API and OneDrive for MISTPEN communication further complicates detection. Traffic toward Microsoft cloud services is extremely common inside enterprise environments and is unlikely to be blocked simply because malware could potentially abuse it. Attackers benefit from hiding command-and-control activity inside infrastructure that organizations already trust and depend upon.

Defenders therefore need behavioural rather than purely destination-based analysis. The relevant question is not merely whether a system contacted OneDrive, but which process initiated the request, whether the user normally uses that service, what volume and sequence of traffic occurred and what endpoint behaviour followed it. Blocking all Microsoft Graph communication to stop one malware family would solve the attack approximately as elegantly as disconnecting the company from the internet.

Lazarus extended the same trusted-infrastructure strategy to its broader command-and-control network. Check Point observed compromised WordPress and SharePoint infrastructure as well as Roundcube webmail servers being used as relay nodes. Many of the compromised Roundcube systems were susceptible to CVE-2025-49113, allowing the attackers to deploy a PHP web shell called RelayShell after obtaining valid credentials.

This creates a second victim population inside the same campaign. One organization may be the espionage target, while another compromised website or mail server becomes infrastructure used to attack somebody else. In at least one case, a compromised organization in France was subsequently used to send spear-phishing messages to additional targets, allowing Lazarus to inherit the reputation and trust associated with a legitimate organization.

This behaviour makes reputation-based network security increasingly fragile. An IP address, domain or server may have been legitimate for years and still become malicious tomorrow because the underlying system was compromised. Security gateways should therefore combine reputation with behavioural analysis and should not assume that traffic is harmless simply because the destination belongs to a previously reputable organization.

The victimology deserves particular attention for India. Check Point identified Indian organizations among targets in this campaign, alongside organizations in France, Germany and Brazil, with a strong focus on defense and aerospace technologies including surveillance systems, drones and robotics. This is consistent with intelligence collection against strategically important industries rather than broad opportunistic malware distribution.

Organizations in these sectors should consequently treat recruitment-themed approaches as part of their threat model. Engineers and specialists in sensitive industries may be approached through LinkedIn or other professional networks using genuine-looking job descriptions and companies they would reasonably consider working for. Attackers are exploiting professional ambition rather than technological ignorance.

Security-awareness training for such personnel needs to move beyond generic advice about spelling mistakes and suspicious attachments. Modern state-sponsored phishing can contain accurate company branding, professionally written job descriptions, believable recruiter identities and websites that rank well in search engines. Employees should verify employment approaches through independently obtained company contacts before installing software or opening unusual protected documents.

Technical staff and executives working in sensitive industries should also avoid opening recruitment material on privileged corporate endpoints where practical. A separate managed browsing or isolation environment can prevent one convincing professional approach from becoming direct access to systems containing sensitive intellectual property.

Application control can substantially reduce this risk. Employees should not normally be able to install arbitrary PDF viewers, networking utilities or executables obtained through unverified recruitment channels. Approved applications can be distributed through managed repositories, with unknown binaries executed only inside isolated environments.

The newly discovered Troy backdoor demonstrates what attackers gain once the delivery chain succeeds. Check Point says the implant supports 17 operator commands covering host reconnaissance, file enumeration, upload and download, directory manipulation, interactive command execution, process termination and reflective DLL injection into other processes. It therefore provides the capabilities needed for sustained remote access and information theft rather than functioning as a simple downloader.

ForestTiger, another backdoor used in the parallel infection chain, similarly provides long-term access after Lazarus validates the victim and escalates privileges. The existence of multiple malware families and infection paths demonstrates operational resilience: blocking one loader or domain does not necessarily dismantle the campaign because the attackers can move between delivery mechanisms while preserving the overall objective.

Detection strategies should therefore concentrate on stable behaviours such as suspicious DLL sideloading, in-memory execution, unexpected child processes from document viewers, kernel privilege escalation, endpoint-security tampering and unusual outbound cloud communications. Indicators such as hashes and domains remain useful for immediate hunting but have shorter lifetimes because attackers can replace them quickly.

Organizations should patch CVE-2026-68820 immediately across supported Windows systems, particularly endpoints belonging to employees in defense, aerospace, engineering, finance, cryptocurrency and other sectors historically targeted by Lazarus. CISA has already added the vulnerability to its Known Exploited Vulnerabilities Catalog, confirming that remediation should be based on observed exploitation rather than theoretical risk.

However, organizations that operated affected Windows systems before August 11 should not assume that installing the patch conclusively removes campaign risk. The vulnerability is used after initial malware execution, so defenders should look for earlier stages of Operation Dream Job as well. Suspicious PDF viewers, `libmupdf.dll` sideloading, MISTPEN activity, SecurityPDF artifacts, FudModule behaviour and unusual cloud communications should be reviewed alongside patch compliance.

If exploitation or malware execution is identified, incident response should treat the endpoint as potentially fully compromised. SYSTEM-level malware capable of interfering with security telemetry creates enough uncertainty that rebuilding the affected machine from a trusted image may be safer than attempting to remove individual components.

Credentials and sessions available to the victim should also be reviewed. A defense engineer or administrator may have access to source repositories, cloud platforms, VPNs and internal file servers. Compromising the workstation is valuable partly because those legitimate access relationships can be abused afterwards.

Privileged access should therefore be short-lived and device-bound wherever possible. One compromised employee workstation should not contain permanent credentials that provide indefinite access to every system the employee has previously administered.

The wider lesson from this Lazarus campaign is that zero-days increasingly function as one component within carefully engineered social attacks. CVE-2026-68820 did not need to deliver the phishing message, convince the victim to open the lure or establish the first process on the endpoint. Its role was to transform successful social engineering into privileged, stealthier and more durable compromise.

That means organizations cannot rely exclusively on patching, just as they cannot rely exclusively on users identifying phishing. Security must provide multiple opportunities to break the chain: verify external identities, control software execution, detect abnormal application behaviour, restrict privilege, patch rapidly, protect endpoint telemetry and prevent compromised identities from automatically reaching critical resources.

Lazarus combines those stages because sophisticated attackers understand that no single technique needs to defeat every defensive control.

Defenders need to design their environments with exactly the same assumption.

The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security flaw impacting Microsoft Windows to deliver a never-before-seen backdoor targeting defense and aerospace companies across France, Germany, Brazil, and India. The activity, per Check Point Research, is part of Operation Dream Job, a long-running cyber espionage and

Source: Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor via The Hacker News — published 12 Aug 2026.