Lazarus Group Exploits New Windows Zero-Day (CVE-2026-68820) in Operation Dream Job¶

The infamous North Korean state-sponsored threat actor, Lazarus Group, has once again demonstrated its sophisticated capabilities by actively exploiting a newly patched Windows zero-day vulnerability. Tracked as CVE-2026-68820, this critical flaw is a use-after-free issue in Windows’ Ancillary Function Driver for WinSock (afd.sys), allowing attackers to achieve SYSTEM privileges on compromised systems. The exploitation is part of their long-running "Operation Dream Job" campaign, primarily targeting job seekers in the defense, aerospace, and aviation sectors across multiple countries.

Operation Dream Job: A Recurring Threat¶

Lazarus Group's "Operation Dream Job" has been a consistent tactic, where attackers pose as recruiters from well-known companies to lure unsuspecting individuals into downloading malicious payloads. This campaign, active since early 2026, has seen variations, with the latest focusing on organizations in Europe and India.

Technical Details: CVE-2026-68820 and the Infection Chain¶

CVE-2026-68820 is a use-after-free vulnerability in afd.sys (Ancillary Function Driver for WinSock). This type of flaw occurs when a program attempts to use memory after it has been freed, often leading to corruption of valid data or execution of arbitrary code. In this instance, the vulnerability allows the Lazarus Group to trigger a race condition and ultimately gain SYSTEM privileges.

The infection chain observed by Check Point, which detailed the attacks, is multi-stage and highly deceptive:

1. Initial Contact: Attackers contact potential victims via professional platforms or direct messaging, posing as recruiters with enticing job offers.
2. Malicious Payload Delivery: Victims are convinced to download an archive containing:
   • A legitimate PDF viewer (for decoy purposes).
   • A malicious DLL.
   • An encrypted payload disguised as a PDF file.
3. DLL Sideloading: The malicious DLL leverages DLL sideloading to execute the Mistpen malware downloader in memory. Simultaneously, a decoy job description is displayed to the victim to maintain legitimacy.
4. Zero-Day Exploitation: Post-reconnaissance and persistence establishment, the attackers exploit CVE-2026-68820 in afd.sys to elevate privileges to SYSTEM.
5. Backdoor Deployment: With SYSTEM privileges, the attackers deploy ForestTiger, a known Lazarus backdoor, allowing for persistent access and control.
6. Troy DLL Implant: A second infection chain was also identified, where victims are directed to a trojanized PDF viewer called "SecurityPDF". This viewer searches for a hidden marker in opened PDF files to execute Troy, a new DLL implant. Troy supports 17 operator commands, including file enumeration/download/upload, data exfiltration, shell access, process termination, and DLL injection.
7. C2 Infrastructure: The command-and-control (C2) infrastructure primarily consists of compromised Roundcube webmail deployments and CMS platforms, many of which are vulnerable to CVE-2025-49113 (a remote code execution flaw exploited since June 2025). The attackers utilize RelayShell, a previously undocumented PHP webshell, as a communication relay.

Impact and Targets¶

The successful exploitation of CVE-2026-68820 grants attackers SYSTEM-level control, enabling comprehensive compromise of target systems and networks. The primary targets are defense, aerospace, and aviation organizations in countries including France, Germany, Brazil, and India. This access allows for:

• Espionage and data exfiltration (sensitive intellectual property, military secrets).
• Further lateral movement within target networks.
• Disruption of operations.

Remediation and Detection¶

Microsoft addressed CVE-2026-68820 as part of its August 2026 Patch Tuesday updates. The US cybersecurity agency CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, emphasizing the urgency of patching for all federal agencies, with a mandatory remediation deadline of two weeks.

Immediate Recommendations for Defenders:

1. Prioritize Patching: Apply the August 2026 Patch Tuesday updates immediately to remediate CVE-2026-68820.
2. Scrutinize Recruiting Outreach: Treat unsolicited recruiting messages, especially those containing attachments or links to download software, with extreme caution. Educate employees about the tactics used in "Operation Dream Job."
3. Monitor for Indicators of Compromise (IoCs): Organizations should review the IoCs provided by Check Point (or other threat intelligence providers) and implement them in their EDR/SIEM solutions. Look for:
   • Unusual DLL sideloading activity.
   • Presence of "Mistpen," "ForestTiger," or "Troy" malware components.
   • Connections to suspicious C2 infrastructure (especially compromised Roundcube/CMS servers).
4. Harden External-Facing Applications: Ensure all public-facing applications, particularly webmail and CMS platforms, are fully patched and hardened against known vulnerabilities like CVE-2025-49113.
5. Implement Principle of Least Privilege: Limit user and application privileges to reduce the potential impact of a successful exploit.

The active exploitation of CVE-2026-68820 by a sophisticated APT like Lazarus Group underscores the ongoing threat posed by state-sponsored actors and the critical importance of timely patching and robust defense-in-depth strategies.