Overview
North Korea's Lazarus Group has been actively exploiting a newly patched Windows zero-day vulnerability — CVE-2026-68820 — as part of its long-running Operation Dream Job campaign, Check Point Research disclosed on August 12, 2026. The campaign targeted defense, aerospace, and aviation organizations across France, Germany, India, and Brazil, with the zero-day active for approximately five weeks before Microsoft issued a patch on Patch Tuesday, August 11, 2026.
The flaw, a use-after-free vulnerability in afd.sys (the Windows Ancillary Function Driver for WinSock), allows a locally authenticated attacker to escalate privileges to SYSTEM level — enabling full kernel-mode control of a compromised machine. CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog following the patch, giving federal agencies a two-week remediation deadline.
Operation Dream Job: Still Active After Five Years
Operation Dream Job has been one of Lazarus Group's most persistent and effective campaigns since its inception in 2020. The playbook relies on fake recruiter outreach — typically over LinkedIn — impersonating hiring managers at prestigious defense contractors such as Lockheed Martin. Targets in the 2026 wave worked on surveillance sensors, drones, and robotics programs, representing high-value intelligence targets for the North Korean regime.
The same campaign abused CVE-2025-49113, a Roundcube webmail vulnerability, to install a PHP webshell called RelayShell on compromised web servers. These servers were then repurposed as command-and-control relay nodes, and in at least one case, a compromised France-based organization was used to spear-phish additional targets — a move designed to bypass reputation-based email filtering.
The Zero-Day: afd.sys Again
CVE-2026-68820 marks the fourth time Lazarus Group has exploited a vulnerability in afd.sys since 2022. The driver, which handles WinSock network socket operations, has proven to be a reliable target for the group. Check Point Research reported the vulnerability to Microsoft on July 28, 2026, and received confirmation within days, with a CVE assigned on August 5.
The exploitation involves triggering a race condition within the driver via a specially crafted application, resulting in a use-after-free condition that corrupts kernel memory in a controlled manner to elevate the attacker's process to SYSTEM privileges.
Two Infection Chains
Check Point identified two parallel infection chains operating simultaneously under Operation Dream Job in this campaign.
Chain 1: LinkedIn Lure → MISTPEN → FudModule
Targets received a ZIP archive via fake LinkedIn recruiter messages. The archive contained a legitimate PDF viewer application bundled with a malicious DLL. Opening the PDF viewer side-loaded the DLL, which installed MISTPEN — an in-memory downloader that communicates exclusively over Microsoft OneDrive via the Graph API, blending malicious C2 traffic with legitimate Microsoft cloud traffic.
MISTPEN then loaded a local privilege escalation module exploiting CVE-2026-68820 to reach SYSTEM, before deploying FudModule v3.1, Lazarus' kernel-mode rootkit. FudModule systematically disabled 94 security monitoring channels, including:
- Event Tracing for Windows (ETW) providers
- Minifilter drivers used by EDR products
- Windows crash-dump logging
With defenses neutered, the final payload ForestTiger backdoor was installed for long-term persistent access.
Chain 2: SEO Poisoning → SecurityPDF → Troy
The second chain used SEO-poisoned websites impersonating Enveil, a real privacy technology company. At least three fake Enveil websites were ranked as top search results and distributed SecurityPDF, a trojanized PDF viewer. SecurityPDF inspects opened PDF files for a hidden embedded marker; when detected, it decrypts and memory-loads embedded malware.
The payload in this chain is Troy, a previously undocumented Lazarus backdoor operating entirely in memory, with a 17-command capability set including file enumeration, bidirectional file transfer, interactive shell access, code injection into running processes, and process termination.
Post-Quantum Operational Security
Notably, at least part of the infrastructure used post-quantum key exchange in its C2 communications — an indication that Lazarus is actively future-proofing its toolchain against potential future decryption of captured traffic by quantum computing capabilities.
Patch and Remediation
Microsoft addressed CVE-2026-68820 in the August 2026 Patch Tuesday release. Organizations should:
- Apply August 2026 Patch Tuesday updates immediately — CVE-2026-68820 is being actively exploited
- Review LinkedIn-originated ZIP archives received by employees in defense, aerospace, or aviation roles
- Audit OneDrive API traffic patterns for unusual Graph API connections from endpoints
- Check for ETW and minifilter driver tampering indicative of FudModule-style rootkit activity
- Block the known C2 IP associated with City-Forum and the relay nodes identified by Check Point
Indicators of Compromise
- Malicious ZIP archives containing a PDF viewer + sideloaded DLL pair
SecurityPDF.exeor variants impersonating legitimate PDF tools- Outbound Graph API traffic to OneDrive from non-standard processes
- Presence of
afd.sys-triggered SYSTEM-level process escalation events - Registry or file artefacts associated with FudModule v3.1