A supposed job posting and a "useful" PDF viewer were enough to open the way to the Windows kernel. CVE-2026-68820, a zero-day vulnerability in the AFD.sys driver, was used by Lazarus to gain SYSTEM access and install malicious tools in defense and aerospace organizations.
Check Point Research links the campaign to Operation Dream Job, a long-running campaign by North Korea’s Lazarus that uses fake job offers. In the new wave, targets included defense technology, aviation and aerospace companies in Europe, India and South America.
The researchers did not publish a full technical analysis of the flaw because Microsoft had already released a fix. However, the presence of the exploit in an active campaign and the listing of CVE-2026-68820 on the CISA list significantly increase the priority for administrators. The case also shows that a trusted brand or professional platform is not enough to confirm the safety of a download.
See also: Microsoft Patch Tuesday August 2026: 421 CVEs and active zero-day in Windows
CVE-2026-68820 and job offers
CVE -2026-68820 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock, known as AFD.sys. The vulnerability could allow a previously authorized local user to execute a specially crafted application and exploit a synchronization error when multiple threads access a socket concurrently. The result is kernel read and write access and local privilege escalation.
According to NVD, the vulnerability is classified as CWE-416 and is on the CISA Known Exploited Vulnerabilities list. Check Point says the exploit has been active since at least early July, while Microsoft patched the issue in updates on August 11. The analysis mainly concerns versions 26100 and 26200 of Windows 11.
Exploitation initially required locally executed code, but social engineering gave Lazarus the necessary first step. This combination explains why the update must be accompanied by control over hiring processes and permitted software downloads.
The PDF and Troy Trap
The initial access was not based on an obviously malicious file. The attackers approached employees with job offers and directed them to an encrypted ZIP file. This contained SecurityPDF, a modified MuPDF-based viewer, as well as a PDF file that acted as bait.
At least three websites mimicked Enveil to make the download appear legitimate. When SecurityPDF opened the specially crafted document, it decrypted an embedded malicious payload and loaded the new Troy. Troy supports 17 operator commands for system identification, file management, command execution, and data transfer.
In a parallel chain, MISTPEN downloaded additional modules via Microsoft Graph and OneDrive. The Check Point team observed functions to collect system information, record processes, and take screenshots. The use of legitimate services and compromised websites makes it difficult to separate malicious traffic from normal activity.
See also: North Korean hackers linked to Diehl Defence breach
FudModule, SYSTEM and the defense of organizations
After successfully exploiting CVE-2026-68820, Lazarus installed a new version of the FudModule at the kernel level. The tool gained SYSTEM privileges, injected malicious payload into a system process, and limited the visibility of EDR solutions. Version 3.1 also includes tampering with Smart App Control to make integrity checks more difficult.
Check Point notes that Microsoft was notified on July 28, confirmed the issue on July 31, and assigned it a CVE identifier on August 5. CISA added it to its list of actively exploited vulnerabilities on August 11, with a patch deadline of August 25 for entities subject to the relevant guidelines.
The campaign did not stop at installing a rootkit. In a separate infrastructure, the operators leveraged compromised Roundcube servers as intermediate nodes and deployed RelayShell, a PHP webshell that relays commands and responses via files. Connecting to such legitimate, but compromised, resources makes detection difficult and requires monitoring of both endpoints and outgoing connections.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Installing Microsoft updates immediately is the key measure for CVE-2026-68820. In addition, organizations need to check Windows 11 endpoints, EDR tools, and software downloads that occurred before August 11. The SecNews technical team recommends additional checks for the names SecurityPDF, Troy, MISTPEN, and FudModule, as well as suspicious job offers that request the installation of a viewer.
See also: Microsoft fixes zero-day in Windows Smart App Control
