Lazarus Group Exploits Windows Zero-Day to Target Defense Sector

The North Korean hacking group Lazarus exploited a zero-day vulnerability (CVE-2026-68820) in the Windows Ancillary Function Driver for WinSock (afd.sys) to gain SYSTEM-level access to defense sector systems. This vulnerability was actively exploited for weeks before a patch was released on August 11, 2026. The attack method involved fake job offers to lure professionals into downloading malicious software, part of the ongoing Operation Dream Job campaign. Affected organizations include defense contractors and aerospace firms in countries like France, Germany, India, and Brazil. The exploit allows attackers to escalate privileges without user interaction, making it particularly dangerous. The vulnerability has a CVSS score of 7.0 and was added to the CISA Known Exploited Vulnerabilities catalog on the same day the patch was released. Check Point Research reported the vulnerability on July 28, 2026, after observing active exploitation since early July.

Key Points: • CVE-2026-68820 is a zero-day vulnerability exploited by Lazarus Group since early July 2026. • The attack vector involves fake job offers targeting defense sector professionals. • Microsoft released a patch on August 11, 2026, after confirming active exploitation.