Meta News

North Korean state-sponsored hackers have been exploiting a previously unknown Windows vulnerability to obtain the highest level of privileges on compromised computers, providing another example of how sophisticated threat actors combine social engineering, zero-day exploits and custom malware into carefully orchestrated espionage operations.

The attacks have been attributed to the Lazarus Group, one of North Korea’s most prominent advanced persistent threat operations, and form part of a new phase of the long-running Operation Dream Job campaign. The operation uses fraudulent employment opportunities to lure professionals into opening malicious files, with recent activity primarily targeting defense, aerospace and aviation organizations in Europe and India. (⁠SecurityWeek)

At the center of the campaign is CVE-2026-68820, a newly patched vulnerability affecting Windows’ Ancillary Function Driver for WinSock, orafd.sys. Attackers exploited the flaw before a patch was publicly available, making it a genuine zero-day.

Successful exploitation allows an attacker who has already gained local access to elevate privileges to SYSTEM, effectively obtaining complete control over the Windows machine. Microsoft patched the vulnerability on August 11 as part of its August 2026 Patch Tuesday updates. (⁠SecurityWeek)

The U.S. Cybersecurity and Infrastructure Security Agency has also added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog, increasing the urgency for organizations to deploy the update. (⁠SecurityWeek)

The campaign demonstrates why Lazarus continues to be considered one of the world’s most capable state-backed cyber operations.

Rather than beginning with indiscriminate malware distribution, the attackers exploit something considerably more difficult for security products to eliminate: professional ambition.

Operation Dream Job has repeatedly targeted employees and job seekers with convincing employment opportunities supposedly originating from recognizable companies. Attackers impersonate recruiters and approach victims through professional networking platforms or direct messaging services.

The objective is to establish enough trust that the victim voluntarily downloads and opens attacker-controlled content.

In the latest campaign, which Check Point says has been active since early 2026, defense-sector targets across multiple countries have received fraudulent recruitment approaches. Aerospace and aviation organizations have been particularly prominent, with victims targeted in countries including France, Germany, Brazil and India. (⁠SecurityWeek)

This targeting is unlikely to be accidental.

Employees working in aerospace and defense environments may possess access to engineering information, intellectual property, military technology, procurement programs, research projects and other material of considerable intelligence value.

A convincing job offer provides an effective mechanism for reaching precisely those individuals.

One infection chain documented by researchers begins with an archive presented to the victim as part of the recruitment process.

Inside are components including a PDF viewer, a malicious DLL and an encrypted payload disguised as a PDF document.

When the victim interacts with the content, the attackers abuse DLL sideloading, a technique that causes a legitimate executable to load a malicious library placed alongside it.

This executes a malware downloader known as Mistpen directly in memory while simultaneously displaying a legitimate-looking job description to the victim. (⁠SecurityWeek)

The deception is important.

From the user’s perspective, the expected document appears.

There is no obvious ransomware message, unusual application or immediate system failure indicating that the computer has been compromised.

Behind the scenes, however, the attackers have established their initial foothold.

The operation then moves through reconnaissance and persistence before reaching one of its most valuable components: exploitation of the Windows zero-day.

CVE-2026-68820 exists withinafd.sys, the Windows kernel-mode driver supporting the Windows Sockets API.

Microsoft describes the vulnerability as a use-after-free condition. An attacker can trigger a race condition that ultimately allows privilege escalation.

The vulnerability does not provide the initial entry point into the machine.

That distinction is important.

An attacker must already have local authenticated access and execute a specially crafted application. But once that foothold exists, exploitation can elevate the attacker to SYSTEM without requiring additional interaction from the victim. (⁠SecurityWeek)

This makes the vulnerability extremely valuable as part of a larger attack chain.

Initial access malware may execute with the permissions of the compromised user. Windows security boundaries can restrict what that process is capable of accessing.

SYSTEM privileges largely remove those restrictions.

An attacker reaching this level can potentially manipulate security controls, access protected information, establish stronger persistence mechanisms and execute additional malware with extensive authority over the operating system.

For an espionage operation, privilege escalation can transform a limited compromise into complete endpoint control.

After exploiting CVE-2026-68820, the attackers deploy ForestTiger, a backdoor previously associated with Lazarus operations.

This provides the attackers with persistent remote access to the compromised environment and allows the operation to progress beyond the initial infection.

The combination is significant.

The attackers are not relying on the zero-day as a standalone weapon. Instead, it forms one stage of a carefully structured intrusion combining social engineering, malware execution, reconnaissance, privilege escalation and persistent command-and-control.

This layered approach illustrates how advanced persistent threats actually use zero-days.

The vulnerability is valuable not because it performs the entire attack, but because it solves a specific problem inside the intrusion chain: obtaining privileges that would otherwise be difficult to acquire.

Check Point also identified another infection mechanism involving a malicious PDF viewer known as SecurityPDF.

Instead of simply opening documents, the trojanized application searches PDFs for a hidden marker. When that marker is detected, the software executes another newly identified backdoor called Troy directly in memory. (⁠SecurityWeek)

Troy provides attackers with a substantial set of capabilities.

Researchers identified 17 commands supported by the implant, including functionality for enumerating files, uploading and downloading data, exfiltrating information, obtaining shell access, terminating processes and injecting DLLs.

The design again demonstrates the importance of memory-resident execution in modern espionage campaigns.

Attackers increasingly attempt to minimize obvious malicious artifacts stored on disk, where antivirus and endpoint security products have traditionally concentrated much of their inspection.

Operating in memory does not make malware invisible, but it can complicate conventional detection.

The campaign’s infrastructure provides another example of Lazarus’ attempts to disguise malicious activity as legitimate web traffic.

Researchers identified compromised Roundcube webmail servers and content management systems being used as part of the command-and-control infrastructure.

Some of those servers were vulnerable to CVE-2025-49113, a remote code execution vulnerability that has been exploited since June 2025. (⁠SecurityWeek)

The attackers deployed a previously undocumented PHP webshell called RelayShell on compromised servers.

Rather than behaving like a traditional webshell intended primarily to provide interactive control over the web server itself, RelayShell operates as an intermediary between infected endpoints and the attackers.

Commands and responses are exchanged through simple text files.

This architecture provides an important operational advantage.

Connections from infected systems lead to apparently legitimate web infrastructure rather than obvious attacker-controlled domains.

Network defenders consequently face the difficult task of distinguishing malicious communications from normal HTTPS traffic to legitimate websites.

The attackers effectively use compromised internet infrastructure as a layer between themselves and their victims.

CVE-2026-68820 is not the first actively exploited vulnerability discovered in the Windows Ancillary Function Driver.

Security researchers have observed multipleafd.syszero-days exploited in recent years, including CVE-2025-32709, CVE-2025-21418 and CVE-2024-38193.

Notably, CVE-2024-38193 was also reportedly exploited by attackers associated with Lazarus. (⁠SecurityWeek)

That history makes the latest vulnerability particularly interesting.

Sophisticated threat actors often develop expertise around specific operating system components. Once researchers understand the architecture, attack surface and potential weaknesses of a subsystem, discovering additional vulnerabilities can become easier.

The repeated targeting ofafd.sysdemonstrates why defenders should examine vulnerability families rather than treating every CVE as an isolated event.

Despite the sophisticated zero-day at the center of the operation, the attack begins with something remarkably ordinary: a conversation about a job.

That combination represents one of the most important lessons from Operation Dream Job.

Lazarus does not need to exploit Windows immediately.

First, it exploits trust.

Recruitment provides particularly effective social engineering because receiving files from recruiters is normal. Candidates expect job descriptions, interview documents, technical exercises and company information.

For employees working in desirable technical sectors, unsolicited approaches from competing companies may not appear suspicious at all.

The attackers construct the social context necessary to make the malicious file believable before relying on technical exploitation.

The zero-day therefore enters the attack only after the victim has already been convinced to execute the initial payload.

The concentration on aerospace, aviation and defense targets elevates the significance of the campaign beyond ordinary cybercrime.

North Korean cyber operations have historically pursued multiple objectives, including financial theft and strategic intelligence collection.

Defense organizations potentially provide information capable of supporting military and technological objectives that would be extremely difficult to acquire through legitimate means.

This makes individual engineers, researchers and technical employees valuable intelligence targets.

Organizations therefore need security awareness programs that extend beyond conventional phishing emails.

Employees should understand that recruitment approaches arriving through professional networking platforms, messaging applications and personal accounts can form part of sophisticated state-sponsored operations.

A message does not become trustworthy simply because it originates outside corporate email.

Microsoft fixed CVE-2026-68820 on August 11, 2026, and organizations running affected Windows systems should prioritize deployment of the August security updates. (⁠SecurityWeek)

Because exploitation occurred before disclosure, defenders should not assume that installing the update proves systems were never compromised.

High-risk organizations should also investigate historical activity.

Security teams should review endpoint telemetry, suspicious DLL sideloading, unusual PDF applications, unexpected persistence mechanisms and indicators associated with Mistpen, ForestTiger, Troy and the infrastructure documented in the campaign.

Connections to unusual Roundcube or compromised CMS infrastructure may also warrant investigation.

For organizations in defense, aerospace and aviation, the threshold for scrutiny should be particularly low.

The Lazarus campaign illustrates why focusing exclusively on individual vulnerabilities can provide an incomplete picture of modern cyber espionage.

CVE-2026-68820 is serious.

But the operation would still require initial access, execution, reconnaissance, persistence and communication infrastructure.

The attackers assembled each component into a coherent chain.

They used fake recruiters to solve the human problem.

Trojanized documents solved initial execution.

DLL sideloading helped disguise malicious activity.

The Windows zero-day solved privilege escalation.

ForestTiger and Troy provided long-term access.

Compromised web servers helped conceal command-and-control communications.

Each technique reinforces the others.

That is what makes sophisticated state-sponsored operations dangerous: not necessarily one extraordinary capability, but the ability to combine many different capabilities into an intrusion that remains effective even when individual defensive controls succeed.

Microsoft has now closed the vulnerability that provided Lazarus with SYSTEM privileges.

But the broader campaign demonstrates a problem that cannot be solved with Patch Tuesday alone.

As long as attackers can combine trusted professional interactions, legitimate-looking software, compromised infrastructure and previously unknown vulnerabilities, organizations defending high-value technology will need to protect not just their operating systems, but the entire chain of trust surrounding the people who use them.