Lazarus Used a Windows Zero-Day to Turn Fake Job Offers Into Full System Takeover
- The Mess: North Korea-linked Lazarus exploited a previously unknown Windows kernel vulnerability, CVE-2026-68820, as part of its long-running Operation Dream Job campaign. Victims were approached with fake recruitment offers, often through LinkedIn, before being pushed toward malicious PDF files or a trojanized PDF viewer. Microsoft patched the zero-day in its August security updates.
This is exactly the kind of attack chain that makes modern targeted attacks so difficult to detect.
There is no obvious “hacking” moment.
First comes a recruiter.
A convincing job offer.
A familiar company name.
A PDF containing what supposedly looks like a job description.
And then the attack starts.
Lazarus has been running this Dream Job operation for years, but the latest campaign adds a previously unknown Windows kernel exploit and a new backdoor called Troy.
The targets included defense, aerospace and aviation organizations in France, Germany, Brazil and India.
And the attackers weren’t simply looking for passwords.
Their goal was much more ambitious:
full control of the Windows machine.
The zero-day was hiding underneath the fake job offer
The vulnerability, CVE-2026-68820, affects Windows AFD.sys — Ancillary Function Driver for WinSock.
It is a local privilege-escalation vulnerability.
That means it isn’t the initial entry point.
Lazarus first needed to get code running on the victim’s computer.
Once they had that foothold, the AFD.sys exploit could elevate privileges to SYSTEM, the highest Windows privilege level.
And that’s an important distinction.
The attack wasn’t:
LinkedIn → Windows zero-day → compromised PC.
It was closer to:
Fake recruiter → malicious file → initial malware → AFD.sys zero-day → SYSTEM → rootkit → persistent backdoor
That’s a considerably more sophisticated chain.
Two different infection chains
Researchers identified two main approaches.
Chain #1: malicious DLL side-loading
The victim receives an encrypted archive containing what appears to be legitimate software and job-related material.
Inside is a legitimate PDF viewer executable accompanied by a malicious libmupdf.dll.
The legitimate application loads the malicious DLL.
That’s DLL side-loading.
The victim sees a convincing job description.
Meanwhile, the malicious DLL starts the real attack.
It loads MISTPEN, performs reconnaissance and persistence operations, and eventually triggers the AFD.sys exploit.
The attackers can then deploy FudModule 3.1 and the ForestTiger backdoor.
Chain #2: fake SecurityPDF
The second approach is even more interesting.
Lazarus created websites impersonating legitimate companies and distributed a trojanized PDF viewer called SecurityPDF.
The victim is told that the job document is encrypted and that they need the special viewer to open it.
The application looks legitimate.
But SecurityPDF monitors PDFs opened through it.
When it detects a particular hidden marker, it decrypts and loads the embedded Troy backdoor directly into memory.
Researchers identified fake sites designed to look like Enveil infrastructure and optimized them to appear in search results.
That is an important detail.
The attackers weren’t relying solely on a suspicious URL arriving in an email.
They were trying to make the victim Google the software and find the malicious site themselves.
Troy gives the attackers a serious toolbox
The newly identified Troy backdoor isn’t just a simple beacon.
Researchers found 17 operator commands.
Those capabilities include:
- interactive shell access;
- file enumeration;
- file upload and download;
- archiving;
- data exfiltration;
- process termination;
- in-memory DLL injection;
- configuration updates.
In other words, once Troy is running, the attacker has a fairly flexible remote-control mechanism.
And because the malware can operate directly from memory, traditional file-based detection becomes considerably more difficult.
Then comes FudModule
This is arguably the nastiest part.
Lazarus deployed FudModule 3.1, an updated kernel-level rootkit.
The new version can interfere with Windows Smart App Control, a security feature designed to determine whether applications are safe to execute. Researchers observed the rootkit modifying the system’s code-integrity policy state.
So the attack doesn’t simply gain SYSTEM privileges.
It then tries to weaken security controls designed to stop malicious software.
That’s a classic escalation:
get execution → become SYSTEM → disable or bypass defenses → establish persistence → operate quietly.
Lazarus didn’t even need its own infrastructure
This might be my favorite detail in the entire campaign.
The attackers didn’t simply build a giant collection of suspicious C2 servers.
They compromised legitimate infrastructure.
Researchers found WordPress and SharePoint websites being used as part of the command-and-control infrastructure.
They also compromised vulnerable Roundcube webmail servers and installed a PHP web shell called RelayShell.
In several cases, legitimate organizations effectively became unwilling participants in the attack.
Their servers became relay points.
Their reputation became useful to the attackers.
Their traffic looked less suspicious.
And in at least one case, a compromised organization was apparently used to send further phishing messages to new victims.
That’s a particularly nasty evolution.
The attacker compromises A.
Then uses A’s reputation to compromise B.
The zero-day was already being exploited
This wasn’t a theoretical vulnerability discovered after the campaign.
Check Point Research said it observed a successful implementation of the vulnerability before disclosure, with exploitation dating back to the campaign period before Microsoft released the August patch. Microsoft subsequently issued the fix in its August security updates.
That makes CVE-2026-68820 much more important than its CVSS score alone suggests.
It’s not merely:
“Windows has a 7.0 vulnerability.”
It’s:
“A state-linked threat actor had an exploit before Microsoft patched the vulnerability and used it as part of an active intrusion campaign.”
That’s a completely different risk calculation.
The Fix
Patch Windows immediately if your systems haven’t yet received Microsoft’s August 2026 security updates.
Then assume the problem is bigger than the CVE.
Because patching AFD.sys doesn’t remove:
- Troy;
- MISTPEN;
- FudModule;
- ForestTiger;
- persistence mechanisms;
- stolen credentials;
- malicious DLLs;
- compromised browser sessions.
If you suspect exposure, investigate the endpoint rather than simply installing the patch and closing the ticket.
Also pay particular attention to employees receiving unexpected recruitment messages, especially when they are asked to install a PDF viewer or other supposedly specialized software.
And this campaign provides another reason to treat LinkedIn and other professional social networks as security-sensitive environments.
A recruiter doesn’t need to be a stranger.
They need to look legitimate.
Bugstoday Opinion
This is what makes Lazarus so dangerous.
The zero-day is impressive.
The rootkit is impressive.
The malware is impressive.
But the social engineering is still doing most of the heavy lifting.
The attacker doesn’t start by exploiting Windows.
They start by exploiting human expectations.
Someone is looking for a better job.
A recruiter contacts them.
The company is real.
The position sounds believable.
The PDF looks professional.
And then the victim voluntarily installs the software.
Only after that does the zero-day become useful.
That’s the lesson.
You can patch Windows and still lose the machine if the attacker convinces someone to install the wrong application.
And Lazarus is combining both sides of the equation:
social engineering + zero-day exploitation + kernel rootkit + compromised third-party infrastructure.
That is a serious attack chain.
Bugstoday verdict: CVE-2026-68820 is patched, but the bigger warning is the attack model. If a “recruiter” asks you to install a special PDF viewer, don’t. Your dream job may come with a kernel rootkit.
