Lazarus Group Exploits Windows Zero-Day in Operation Dream Job Campaign

In a sophisticated convergence of nation-state espionage, advanced cryptologic engineering, and zero-day vulnerability exploitation, the North Korea-linked Lazarus Group has launched a high-impact offensive targeting the global defense, aerospace, and aviation sectors. Security researchers at Check Point Research, alongside government cyber defense agencies, released emergency threat advisories detailing a newly uncovered wave of the threat actor’s persistent espionage initiative known as “Operation Dream Job”. This campaign combines hyper-targeted social engineering with a newly weaponized zero-day local privilege escalation vulnerability in Microsoft Windows, tracked as CVE-2026-68820. By disguising malicious payloads within legitimate-looking recruitment lures and utilizing advanced post-quantum cryptographic handshakes to deliver kernel-level exploits, the Lazarus Group has once again demonstrated its ability to bypass modern Endpoint Detection and Response (EDR) platforms, compromise high-value military industrial targets, and operate undetected deep within corporate network infrastructures.

The Architecture of Operation Dream Job: Social Engineering and Initial Access

The latest iteration of Operation Dream Job represents a significant evolution in threat actor lure mechanics and initial access strategy. Posing as human resources executive personnel and corporate talent recruiters from leading global defense contractors—including Lockheed Martin and Enveil—the attackers initiate contact with target individuals via professional networking platforms like LinkedIn, as well as encrypted direct messaging applications such as Telegram and WhatsApp. The primary targets of this campaign include engineers, systems architects, and research scientists specializing in military drones, robotics, and advanced surveillance sensor systems across Western Europe (specifically France and Germany), Brazil, India, and North America.

To establish rapport and maintain authenticity, the attackers conduct extended conversational dialogue with prospective victims before presenting lucrative employment opportunities. Once trust is established, victims are instructed to download lure packages containing official job specifications. However, the delivery infrastructure extends far beyond direct messaging. Researchers observed that the threat actors established spoofed corporate recruitment portals and executed search engine optimization (SEO) poisoning tactics to ensure targets searching for defense vacancies organically landed on attacker-controlled distribution nodes.

The initial delivery package typically arrives as an encrypted archive (such as a ZIP file) designed to bypass perimeter email gateways and secure web gateways. Within this archive, the attacker includes three core artifacts:

• Legitimate Signed Executable: A digitally signed, benign binary designed to function as a custom PDF viewer executable, dubbed “SecurityPDF” (built on top of the open-source MuPDF library).
• Malicious Side-Loaded Library: A trojanized Dynamic Link Library (DLL) named libmupdf.dll, designed to be automatically executed when the benign binary initializes.
• Encrypted Payload Data: An obfuscated payload file masquerading under a benign .pdf extension containing both the lure document and initial stage shellcode.

Execution Mechanics: DLL Sideloading, MISTPEN, and Troy Backdoor

When the target opens the fake job offer using the provided executable, the system initiates a classic DLL sideloading sequence. The benign binary loads libmupdf.dll from the current working directory instead of system libraries. Upon execution, libmupdf.dll extracts and displays a legitimate decoy PDF document detailing the defense contractor job opening to avoid raising victim suspicion. Simultaneously, the DLL silently allocates memory, decrypts an embedded payload, and executes an in-memory downloader known as MISTPEN without dropping secondary binaries to disk.

MISTPEN serves as a lightweight, highly stealthy reconnaissance and initial stage staging module. It executes host environment profiling, gathering computer names, domain configurations, OS patch levels, running process lists, and active security product telemetry. To evade network-based detection, MISTPEN establishes command-and-control (C2) communications through legitimate cloud infrastructure. The malware interacts with attacker-controlled files hosted on Microsoft OneDrive via the official Microsoft Graph API, blending C2 communications into normal corporate HTTPS network traffic.

Depending on host profiling metrics, MISTPEN retrieves and executes secondary payloads in memory. Key among these secondary components is a novel, previously undocumented 64-bit modular Remote Access Trojan (RAT) named Troy. The Troy backdoor equips the attackers with a comprehensive suite of post-exploitation commands, including:

1. System Information Reconnaissance: Deep extraction of active network interfaces, mapped network drives, user account privileges, and installed software registries.
2. File System Manipulation: Arbitrary file searching, directory enumeration, file download, upload, and secure file wipe routines.
3. Process Injection and Execution: Capability to spawn suspended system processes and inject shellcode into legitimate Windows binaries.
4. Command Execution: Direct interactive command-line shell spawn with standard input/output piping over encrypted C2 sockets.
5. Credential Harvesting: Dumping browser stores, LSASS memory, and saved system secrets to facilitate lateral movement across the enterprise network.

CVE-2026-68820: Kernel-Level Exploitation in afd.sys

To transition from a low-privilege user foothold to complete machine takeover, the attackers deploy a weaponized zero-day exploit targeting CVE-2026-68820. This vulnerability is located in the core Microsoft Windows kernel driver responsible for network socket operations: the Ancillary Function Driver for WinSock (afd.sys). The flaw stems from a Use-After-Free (UAF) race condition within the driver’s socket handling routines when managing asynchronous I/O requests.

By executing a precisely timed race condition sequence, an unprivileged user-mode process can cause afd.sys to reference a freed kernel object. The exploit corrupts adjacent memory structures, enabling the attacker to manipulate kernel page tables and overwrite kernel pointers. Successful exploitation allows the unprivileged process to elevate its privileges directly to SYSTEM, the highest privilege level on a Windows operating system.

A notable aspect of this campaign is the advanced cryptologic engineering employed during the exploit delivery phase. Before requesting the zero-day payload, MISTPEN’s exploit loader module fingerprints the target host and initiates a specialized handshake with the C2 server. To prevent security analysts and network inspection appliances from intercepting the exploit code, the module requests public keys from the command server and establishes a post-quantum key exchange mechanism using Kyber/ML-KEM—the key encapsulation standard approved by the National Institute of Standards and Technology (NIST) to resist quantum decryption.

The encapsulated secret is returned to the server, establishing an ephemeral key set. The incoming zero-day exploit payload is doubly encrypted using a combination of GOST-CBC encryption layered over MISTPEN’s native AES transport layer encryption, ensuring the zero-day binary is decrypted exclusively inside volatile memory on the target system.

FudModule Rootkit v3.1: Blinding EDR and Disabling Kernel Telemetry

Once SYSTEM-level privileges are established via CVE-2026-68820, the attackers deploy an updated variant of their signature kernel-mode rootkit, tracked as FudModule v3.1. Operating with direct kernel access, FudModule executes Direct Kernel Object Manipulation (DKOM) to systematically blind local security software and dismantle Windows kernel diagnostic tools.

FudModule v3.1 incorporates several sophisticated defense-evasion mechanisms:

• Telemetry Callback Neutralization: Unhooks and nullifies Kernel Callbacks registered by Endpoint Detection and Response (EDR) drivers for process creation, thread creation, image loading, and handle creation.
• Minifilter Removal: Unregisters file system minifilter drivers, preventing security tools from inspecting file creation, modification, or deletion operations on disk.
• NT Kernel Logger Termination: Forcefully terminates the NT Kernel Logger session to stop system-wide event collection.
• ETW Provider Blinding: Disables 94 Event Tracing for Windows (ETW) kernel providers, blinding centralized SIEM solutions and local security logs.
• Smart App Control & SAC Tampering: Modifies kernel-level enforcement flags governing Microsoft Smart App Control and Windows Defender Application Control (WDAC), enabling unverified binaries to execute without security prompts.

To further obscure their operational footprint, the threat actors avoid hosting command-and-control servers on dedicated attacker infrastructure. Instead, they compromise legitimate third-party web servers by exploiting known flaws, such as CVE-2025-49113 in Roundcube webmail servers, as well as vulnerabilities in WordPress and PrestaShop environments. On these compromised platforms, the attackers install a specialized PHP webshell named RelayShell. RelayShell operates as a bidirectional relay node, routing malicious traffic through legitimate, trusted domain names and effectively obfuscating the ultimate origin of the attacker C2 servers.

Lazarus Group Campaign Impact, Remediation, and Enterprise Mitigation

The discovery of this zero-day wave led to rapid industry coordination. Security researchers at Check Point Research responsibly disclosed the details of CVE-2026-68820 to Microsoft on July 28, 2026. Microsoft addressed the flaw in its August 11, 2026 Patch Tuesday update release, classifying CVE-2026-68820 as a high-severity (CVSS 7.0) local privilege escalation flaw under active exploitation. On August 12, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) officially added CVE-2026-68820 to its Known Exploited Vulnerabilities (KEV) catalog, issuing a mandatory directive for federal agencies and enterprise networks to deploy security updates immediately.

Because the Lazarus Group leverages rootkit techniques capable of disabling EDR sensors after privilege escalation, defense teams cannot rely solely on post-compromise endpoint alerts. Enterprise security teams should implement the following mitigation measures:

1. Immediate Kernel Patching: Prioritize the deployment of Microsoft’s August 2026 security updates to address CVE-2026-68820 across all Windows endpoints and servers.
2. Restrict Unsigned DLL Sideloading: Enforce strict application control policies using AppLocker or WDAC to block unsigned DLL execution from user-writable directories (e.g., AppData, Temp, and Downloads).
3. Network & API Monitoring: Monitor enterprise Microsoft Graph API and OneDrive traffic for anomalous file read/write operations originating from non-standard or unverified binary processes.
4. Social Engineering & Recruitment Awareness: Educate personnel in sensitive defense, aerospace, and engineering roles regarding recruiter impersonation tactics and enforce policies prohibiting the opening of job files received via personal messaging channels.