Lazarus Group Hacked Defense Workers With Windows Kernel Zero

A kernel-level flaw buried in the Windows networking stack let North Korean spies seize full system control over defense and aerospace targets while dressed as recruiters — for weeks before a patch arrived.

Defense contractors, aerospace engineers, and aviation professionals across France, Germany, India, and Brazil spent at least the past several weeks with a North Korean state- rootkit operating invisibly on their machines — below the floor of nearly every endpoint security tool deployed to catch exactly this kind of intrusion. The vehicle was a fake job offer. The payload was a kernel zero-day that Microsoft patched on August 11 as part of its August Patch Tuesday release, one day after a full technical disclosure from the researchers who found it Check Point Research .

The vulnerability, tracked as CVE-2026-68820, is a use-after-free race condition in afd.sys — the Ancillary Function Driver for WinSock, the kernel-mode component that manages network socket operations for virtually every Windows application. When two competing threads race to access socket state without proper synchronization, an attacker can time the race to corrupt freed memory and obtain a kernel read/write primitive — a foothold below the operating system's own protection mechanisms, producing full SYSTEM-level privileges. No user interaction is required once the exploit fires. The flaw received a CVSSv3 score of 7.0, rated Important — a number that Trend Micro Zero Day Initiative head of threat awareness Dustin Childs and multiple security vendors publicly noted understates the urgency of a confirmed, in-the-wild zero-day exploit targeting the defense sector ZDI August 2026 analysis .

Check Point Research reported the vulnerability to Microsoft on July 28, 2026. Microsoft confirmed the issue within days, formally assigned it CVE-2026-68820 on August 5, and shipped the patch on August 11 as part of Patch Tuesday. CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog on August 11 — the same day the patch released — with a federal remediation deadline of August 25 for all US civilian executive branch agencies. By the time the fix landed, Lazarus had been running the exploit for at least five weeks: a compiled FudModule rootkit artifact carries a timestamp of July 7, 2026 Check Point Research report .

The exploitation of CVE-2026-68820 is embedded in a fresh wave of Operation Dream Job, the long-running North Korean espionage campaign that uses fake recruiting pitches to lure technical professionals into installing malware Operation Dream Job coverage . The campaign has run in various forms since at least 2020, but this year's iteration targets the defense, aerospace, and aviation sectors specifically, with documented compromises in Western Europe — including organizations headquartered in France, which Lazarus used as a relay to reach additional targets — as well as Germany, India, and Brazil post-quantum key exchange detail .

Check Point identified two parallel infection chains running simultaneously in this campaign. Both begin with the same social engineering hook — a convincing outreach message, likely via , impersonating a recruiter at a recognized company offering an attractive technical role.

Chain 1 uses DLL sideloading. Victims receive an encrypted ZIP archive containing three files: a legitimate, digitally signed PDF viewer executable, a malicious library named libmupdf.dll , and an encrypted payload with a PDF extension. When the victim launches the viewer, Windows loads libmupdf.dll in place of the authentic MuPDF library. That malicious DLL decrypts and displays a convincing Lockheed Martin job description PDF — providing the victim a plausible reason to have opened the archive — while simultaneously decrypting and executing the MISTPEN downloader directly in memory, leaving no suspicious file on disk. MISTPEN communicates with attacker infrastructure not through dedicated command-and-control servers but through attacker-controlled files hosted on Microsoft OneDrive, using the Microsoft Graph API. By routing all command traffic through legitimate Microsoft cloud services, the campaign blends its malicious traffic with the OneDrive and Microsoft 365 connections that appear on virtually every enterprise network, making network-based detection significantly harder MISTPEN OneDrive C2 analysis .

Chain 2 , observed in July 2026, distributes SecurityPDF — a trojanized version of the open-source MuPDF viewer — from websites impersonating Enveil, a legitimate privacy technology company. Check Point found no evidence Enveil itself was compromised. Some of the impersonation sites ranked as the top result for relevant queries, a position the attackers secured through deliberate SEO manipulation. Victims who install SecurityPDF and open an attacker-prepared PDF trigger a hidden marker check inside the application; when the marker is present, the application decrypts an embedded payload using a single-byte XOR key, writes a launcher to the user's temporary directory, and executes it. That launcher reflectively loads Troy , a newly documented Lazarus backdoor with 17 commands — file browsing and enumeration, data upload and download, interactive command shell, code injection into running processes, and process termination. Troy operates entirely in memory once loaded Check Point Research report .

The technical heart of the campaign is the CVE-2026-68820 exploit, which turns a concurrency bug in one of Windows' most foundational network drivers into a complete system takeover SecurityWeek Patch Tuesday analysis .

afd.sys — the Ancillary Function Driver for WinSock — is a kernel-mode component responsible for processing all socket operations that user-mode applications make through the Windows Sockets API. Because it handles network communication at the kernel level, it operates with privileges no user-space security control can intercept. This makes bugs in the driver disproportionately dangerous: any memory-safety flaw becomes a path from standard user privileges to full SYSTEM control.

CVE-2026-68820 exploits a race condition in the driver's concurrent socket-handling code. Two code paths operate on socket state simultaneously without proper synchronization. When an attacker times the race correctly — triggering one path to free memory while another path retains a reference — the freed memory can be reallocated to attacker-controlled content before the second path uses it, yielding a kernel read/write primitive. That primitive is then used to escalate from the initial malware foothold to SYSTEM-level privileges, the highest level of access on any Windows host.

This is not the first time Lazarus has exploited a use-after-free in the same driver. CVE-2024-38193, patched by Microsoft in August 2024, was a structurally similar flaw in afd.sys that Lazarus also exploited to deploy an earlier FudModule variant. Tenable senior staff research engineer Satnam Narang specifically flagged the pattern in his August 2026 Patch Tuesday analysis: "Since 2022, there have been three other afd.sys zero-days exploited in the wild, including CVE-2025-32709, CVE-2025-21418, and CVE-2024-38193. CVE-2024-38193 was reportedly exploited by North Korean hackers linked to the Lazarus group." Tenable patch priority guidance

The implication of that pattern is not simply that this CVE needed patching. The AFD.sys driver is written in C, a language that requires manual memory management. Its socket-handling code paths handle concurrent access, and concurrent manual memory management in C is precisely where use-after-free vulnerabilities arise. Each individual patch repairs the specific flaw; the architectural conditions that produce these flaws remain.

Once CVE-2026-68820 delivers SYSTEM privileges, the campaign deploys its most technically sophisticated component: FudModule v3.1 , a kernel-mode rootkit Lazarus has refined over multiple years and multiple zero-days FudModule v3.1 technical breakdown .

FudModule is purpose-built to eliminate the visibility that endpoint detection and response tools depend on. Once installed at SYSTEM privileges, it operates by directly manipulating Windows kernel data structures responsible for telemetry:

It zeroes EtwpActiveSystemLoggers inside the _ETW_SILODRIVERSTATE kernel structure, immediately killing the NT Kernel Logger and all CKCL logger sessions. It then walks nt!EtwRegister call sites in kernel memory to locate and zero the REGHANDLE globals for individual providers — silently dropping events before they reach any consumer. In version 3.1, this process blinds 94 Event Tracing for Windows providers , including those used by most commercial EDR products for kernel-level visibility FudModule kernel telemetry detail . It also disables minifilter drivers, object callbacks, and registry callbacks that security products register to monitor system activity.

New in v3.1 compared to the 2024 build: FudModule now targets Windows Smart App Control by resetting its reputable-policy state and forcing a code-integrity policy reload — a capability that degrades one of Windows 11's primary defenses against untrusted code. The version drops the dedicated Microsoft Defender-disabling and AhnLab-specific bypass routines from its predecessor in favor of a generic security-product suppression engine that targets any product relying on ETW for kernel telemetry Smart App Control bypass analysis .

Once FudModule completes its blinding operation, it reinjects a fresh instance of MISTPEN into a SYSTEM process, allowing subsequent operations to run with kernel-level authority and no visibility. The final deployed payload is ForestTiger , a well-documented Lazarus backdoor that provides long-term remote access to the compromised host.

For defenders, the EDR evasion capability is the hardest operational reality: a FudModule-compromised machine generates no alerts from tools that depend on ETW, minifilter drivers, or registry callbacks for their kernel-level sensors. The rootkit operates below the threshold at which most detection and response technology can see it.

"What makes this campaign so dangerous is not only the zero-day vulnerability — but also how Lazarus wove legitimate, trusted infrastructure into every stage of the attack," said Sergey Shykevich, director of threat intelligence at Check Point Software. "They hid in plain sight, behind top-ranked results, real vendor branding, and the reputation of organizations they had already compromised." Shykevich quote on hidden infrastructure

That last point refers to the campaign's relay infrastructure: Lazarus routed command-and-control traffic not through its own servers but through third-party Roundcube webmail and WordPress and PrestaShop installations it had compromised, exploiting CVE-2025-49113 in vulnerable Roundcube deployments with credentials likely obtained from dark-web credential markets. On each compromised server, Lazarus deployed RelayShell , a PHP web shell that stores sessions and message exchanges in temporary files and relays them to operators, making the attack infrastructure nearly indistinguishable from legitimate web traffic RelayShell infrastructure analysis .

For enterprises, the immediate action is deploying the August Patch Tuesday update to install the fix for CVE-2026-68820. Security researchers recommend applying this update within 24 to 48 hours on systems where locally authenticated users could run untrusted applications — which in practice includes most enterprise endpoints Automox patch priority guidance .

Beyond patching, organizations in the defense, aerospace, and aviation sectors should brief employees directly on the Operation Dream Job lure methodology. Lazarus has refined fake recruiting tactics for years precisely because they consistently work: the promise of a better role at a well-known company is one of the most effective social engineering hooks for technical professionals. Security awareness training that explicitly covers unsolicited job offers paired with software download requests — whether the software is a PDF viewer, a coding assessment, or a file transfer tool — is directly applicable here.

At the network level, monitoring for unexpected outbound connections from processes with no business reason to communicate with Microsoft Graph API or OneDrive endpoints can surface MISTPEN activity. Not all OneDrive traffic is suspicious; the signal is a process — such as a PDF viewer, a document editor, or any application that has never previously communicated with Microsoft's cloud — establishing a Graph API connection for the first time. Behavioral endpoint controls that detect in-memory code execution and cross-process injection provide the most relevant layer against FudModule specifically, given its explicit design to defeat signature-based and ETW-dependent detection.

For organizations running Roundcube webmail, auditing for the presence of PHP files in unexpected paths — particularly files serving relay or proxy functions — can reveal RelayShell deployments that may indicate the server has been used as infrastructure by this campaign even if the organization itself is not a primary target.

CVE-2026-68820 is not the first time Lazarus has exploited a use-after-free vulnerability in the Windows AFD.sys driver, and the evidence suggests it will not be the last. CVE-2024-38193, patched in August 2024, was structurally identical — a use-after-free in the same driver, also used to deploy FudModule. Two additional AFD.sys privilege escalations were exploited by other threat actors in February and May 2025 AFD.sys pattern SecurityWeek detail .

The driver's role — as the kernel-mode boundary for all Windows socket operations — makes it both universally present and consistently high-value for anyone who wants SYSTEM privileges on a Windows machine. As Ivanti principal product manager Todd Schell noted in the August Patch Tuesday analysis, afd.sys "has been a recurring target for local privilege-escalation bugs throughout 2026" afd.sys recurring vulnerability pattern .

The broader August 2026 Patch Tuesday context provides useful scale: Microsoft patched between 398 and 421 CVEs in this release (the spread reflects different counting methodologies across Tenable, SecurityWeek, and BleepingComputer), making it the second-largest Patch Tuesday on record after July 2026's 622 second-largest Patch Tuesday context . The AI-powered vulnerability discovery system behind those volume figures — Microsoft's MDASH (Multi-Model Agentic Scanning Harness) — continues to run continuously against the Windows codebase, driving what Childs described as "massive patch loads are officially the 'new normal.'" ZDI massive patch load analysis

The critical distinction the data supports: of more than 35,000 CVEs published across all vendors in the first half of 2026, only 85 made it into CISA's Known Exploited Vulnerabilities catalog — 0.24 percent. CVE-2026-68820 is in that 0.24 percent. That makes it the only vulnerability in the August release that demands a patch before any other prioritization exercise begins KEV catalog 0.24 percent context .

The campaign's broader shape is worth understanding beyond the specific CVE. Operation Dream Job works because it targets a specific human psychology — the combination of professional ambition and the familiarity of as a trusted professional networking context. The fake Enveil websites appeared at the top of results. The job description was a convincing Lockheed Martin document. The PDF viewer was a real, signed, legitimate piece of software modified at the binary level. Every visual signal a target could rely on said "legitimate." None of the standard warning signs — an unusual email address, a suspicious sender domain, an unfamiliar tool — were present.

The question every defense professional should now be asking before downloading software at a recruiter's request: did I verify this application's hash against an official source, or did I trust the result that appeared at the top of the page?

CVE-2026-68820 is a use-after-free race condition in afd.sys , the Windows kernel driver that handles all socket operations through the Windows Sockets API. An attacker who already has a foothold on a machine can trigger a race condition between two concurrent threads accessing the same socket state without synchronization, exploit the resulting kernel read/write primitive, and escalate from standard user privileges to full SYSTEM access — the highest privilege level on any Windows host. No user interaction is required. Microsoft confirmed active exploitation by Lazarus Group before the August 11 patch shipped. CISA added it to the Known Exploited Vulnerabilities catalog the same day. Yes: patch immediately, within 24 to 48 hours. The CVE is rated Important (CVSS 7.0), not Critical, but confirmed active exploitation by a nation-state actor targeting the defense sector overrides that scoring label in any rational prioritization framework Tenable patch priority guidance .

The campaign uses one of two infection chains, both beginning with a fake recruiter approach — likely via — offering an attractive job at a well-known company. In the first chain, the target receives a ZIP archive containing a legitimate PDF viewer and a malicious DLL; opening the viewer silently loads the DLL, which runs MISTPEN, an in-memory downloader that communicates through Microsoft OneDrive rather than suspicious standalone servers. In the second chain, the target is directed to a -engine-optimized website impersonating Enveil, a real privacy technology company, to download SecurityPDF — a modified PDF viewer that executes hidden malware when the target opens a specially crafted PDF. Either chain eventually loads a privilege escalation module that fires the CVE-2026-68820 exploit, delivers FudModule to the kernel, and establishes ForestTiger as a persistent remote access backdoor. The attacker then has SYSTEM-level control over the compromised machine Help Net Security Lazarus report .

FudModule v3.1 operates at the kernel level — the same level at which the operating system itself runs — which places it below the visibility floor of most endpoint detection and response tools. Once deployed, it zeroes the Windows kernel data structure that tracks which telemetry loggers are active, immediately killing the NT Kernel Logger and any associated logging sessions. It then locates and nullifies the registration handles for 94 Event Tracing for Windows providers, silently dropping security-relevant events before they reach any consumer — including your EDR's kernel-level sensors. It also disables the minifilter drivers and registry callbacks that security products register to monitor file system and registry operations. The result is a machine that appears normal to security tools while attackers operate freely. Behavioral controls that detect the absence of expected telemetry — rather than the presence of malicious signals — offer the most promising detection path Infosecurity FudModule EDR evasion .

afd.sys is written in C and manages concurrent socket operations — precisely the combination that produces use-after-free vulnerabilities. When multiple threads access the same memory object simultaneously without proper synchronization, one thread can free memory while another retains a reference to it; an attacker who controls the timing of this race can write attacker-controlled content into the freed memory and redirect kernel execution. Lazarus has now exploited at least two separate use-after-free flaws in this same driver: CVE-2024-38193 in August 2024 and CVE-2026-68820 now. Microsoft patches each discovered flaw, but the underlying architecture — concurrent manual memory management in a kernel component with a large IOCTL-based attack surface — continues to create conditions in which these vulnerabilities arise. Each patch repairs a specific race; the conditions that generate races remain until the driver is rewritten in a memory-safe language or architecturally restructured SecurityWeek afd.sys history .