Back Nknews

North Korean hackers exploit previously unknown flaw to target defense firms

Nknews • August 12, 2026

Lazarus used fake job offers, new malware and compromised web servers to evade detection and gain deeper access

Shreyas Reddy August 12, 2026

North Korean cybercriminals exploited a previously unknown weakness in Microsoft Windows in a campaign targeting defense organizations, using newly identified malware to gain access to computers.

The Pyongyang-backed Lazarus Group took advantage of the zero-day vulnerability, designated CVE-2026-68820, as part of a long-running cyberespionage campaign, Israeli cybersecurity company Check Point said in a report published Tuesday.

The flaw, which affected a Windows component responsible for handling network connections, was being exploited since at least early July and potentially allowed attackers to obtain the highest level of system privileges, giving them extensive control over breached

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Lazarus Group Exploits Windows Zero-Day to Target Defense Sector The North Korean hacking group Lazarus exploited a zero-day vulnerability (CVE-2026-68820) in the Windows Ancillary Function Driver for WinSock (afd.sys) to gain SYSTEM-level access to defense sector systems. This vulnerability was actively exploited for weeks before a patch was released on August 11, 2026. The attack method involved fake job offers to lure professionals into downloading malicious software, part of the ongoing Operation Dream Job campaign. Affected organizations include defense contractors and aerospace firms in countries like France, Germany, India, and Brazil. The exploit allows attackers to escalate privileges without user interaction, making it particularly dangerous. The vulnerability has a CVSS score of 7.0 and was added to the CISA Known Exploited Vulnerabilities catalog on the same day the patch was released. Check Point Research reported the vulnerability on July 28, 2026, after observing active exploitation since early July. 33 sources 81

Extracted Entities

North Korean hackers exploit previously unknown flaw to target defense firms

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)

Platforms (1)