Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor

Overview

The North Korean state-sponsored threat actor Lazarus Group has added another kernel-level exploit to its arsenal, weaponizing a previously unknown vulnerability in the Windows Ancillary Function Driver (afd.sys) — tracked as CVE-2026-68820 — to elevate privileges to SYSTEM and deploy a sophisticated multi-stage malware suite that systematically dismantled endpoint defenses.

Disclosed publicly on August 12, 2026 by Check Point Research and The Hacker News, the attack represents a significant escalation in Lazarus' offensive capability: not just exploiting the kernel, but using that access to blind security products before dropping novel backdoors. Microsoft patched the vulnerability on August 11, 2026 — but not before Lazarus had five weeks of unimpeded exploitation.

The Vulnerability: afd.sys Use-After-Free

CVE-2026-68820 is a use-after-free race condition in afd.sys, the Windows kernel driver responsible for WinSock network socket abstraction. The flaw is triggered by a specially crafted user-mode application that races against asynchronous socket operations inside the driver, corrupting freed kernel memory in a controlled way.

The result: privilege escalation from a standard local user session to NT AUTHORITY\SYSTEM — the highest Windows privilege level, with full kernel access. CVSS score: 7.0.

This is notably the fourth afd.sys vulnerability Lazarus Group has exploited since 2022, suggesting a sustained investment in understanding this particular driver's attack surface. Check Point researchers reported the flaw to Microsoft on July 28, 2026; the CVE was assigned August 5.

FudModule v3.1: Blind the Defenders First

Upon achieving SYSTEM privileges, Lazarus did not immediately deploy a backdoor. Instead, the group ran FudModule v3.1, their kernel-mode rootkit, whose sole purpose is to destroy endpoint visibility before the final payload lands.

FudModule v3.1 systematically killed 94 security monitoring channels, including:

With 94 telemetry channels silenced, the compromised host became effectively invisible to the organization's security operations center.

The Payloads: ForestTiger and Troy

Lazarus deployed two distinct backdoors across two parallel infection chains operating simultaneously.

ForestTiger — OneDrive as C2

ForestTiger is a persistent backdoor that uses Microsoft OneDrive via the Graph API as its command-and-control channel. By routing all C2 communications through legitimate Microsoft infrastructure, ForestTiger blends malicious traffic with normal cloud service activity — making network-level detection extremely difficult without deep inspection of Graph API call patterns.

ForestTiger is installed in the infection chain that begins with fake LinkedIn recruiter messages: a ZIP containing a legitimate PDF viewer sideloads a malicious DLL (MISTPEN), which downloads and installs the backdoor after using CVE-2026-68820 to reach SYSTEM.

Troy — Fully Memory-Resident

Troy is a previously undocumented Lazarus backdoor that operates entirely in memory, leaving no disk artifacts. It is deployed via SEO-poisoned download sites impersonating Enveil, a legitimate privacy technology company, distributing a trojanized PDF viewer called SecurityPDF.

SecurityPDF checks opened PDFs for a hidden binary marker; when present, it decrypts and loads Troy directly into memory. Troy exposes a 17-command capability set:

• File system enumeration and browsing
• Bidirectional file upload/download
• Interactive remote shell
• Code injection into running processes
• Process listing and termination

Operating entirely in memory makes Troy resistant to traditional file-based detection and forensic acquisition.

Post-Quantum Operational Security

The campaign employed post-quantum key exchange algorithms in at least part of its C2 infrastructure — a forward-looking operational security measure designed to make captured encrypted traffic resistant to future decryption by quantum computing. This level of cryptographic sophistication is unusual for APT tooling and signals a long-term investment in protecting intelligence value from current-day traffic captures.

Why This Matters

This campaign illustrates the layered sophistication Lazarus Group now deploys routinely:

1. Initial access: Highly targeted social engineering (fake LinkedIn recruiters) and search engine manipulation (SEO-poisoned downloads)
2. Privilege escalation: Zero-day kernel exploit in a repeatedly targeted driver
3. Defense evasion: Rootkit systematically destroying 94 monitoring channels before payload delivery
4. Persistence: Cloud-tunneled C2 via legitimate Microsoft infrastructure
5. Stealth: Memory-only malware with no filesystem footprint
6. Future-proofing: Post-quantum cryptography protecting operational data

Detection and Response

Organizations should treat any system in the defense, aerospace, or aviation sector as a potential target.

Immediate actions:

• Apply Microsoft's August 2026 Patch Tuesday updates to address CVE-2026-68820
• Search endpoint telemetry for ETW provider tampering or minifilter driver unloading events
• Audit OneDrive API traffic from endpoint processes for anomalous Graph API access patterns
• Hunt for in-memory process injection events without corresponding on-disk executables
• Review LinkedIn-sourced ZIP archives received by technical staff in high-value roles

Longer-term:

• Implement kernel integrity monitoring capable of detecting rootkit-style driver manipulation
• Deploy behavior-based detection for post-exploitation privilege escalation patterns
• Consider network-level inspection of Microsoft Graph API traffic from endpoints

References

• Check Point Research: Shattering the Dream
• The Hacker News: Lazarus Exploits Windows Zero-Day
• Infosecurity Magazine: Lazarus Post-Quantum Key Exchange
• GBHackers: Windows AFD.sys Zero-Day