The Cybersecurity and Infrastructure Security Agency (CISA) has mandated that federal agencies patch a critical Microsoft Windows vulnerability, CVE-2026-68820, by August 25. This directive follows confirmation from both CISA and Microsoft that the flaw is actively being exploited in real-world attacks, notably by North Korean state-sponsored hackers.
The vulnerability affects Winsock, a component that facilitates internet connectivity for web browsers. Microsoft identified CVE-2026-68820 as the sole actively exploited flaw in its recent Patch Tuesday release. The bug, which has a severity score of 7 out of 10, allows an attacker who has already gained a low-privileged foothold on a system to escalate their access to full system control. A device restart is required after applying the patch, and no workarounds are available.
The exploitation of CVE-2026-68820 is part of a broader, long-running North Korean campaign known as "Operation Dream Job." This campaign, tracked by threat researchers since 2020, involves hackers impersonating recruiters from prominent companies to target individuals in the defense and aerospace industries. Check Point researchers disclosed the vulnerability to Microsoft after discovering its use in the latest wave of these attacks.
In the current phase of Operation Dream Job, the Lazarus Group, a hacking operation linked to North Korea’s Reconnaissance General Bureau, has been impersonating recruiters from companies such as Lockheed Martin and privacy-tech firm Enveil. They contact job seekers on platforms like LinkedIn and then send malicious PDF files. When opened, these files deploy a backdoor, granting the attackers long-term remote access. The malware first gathers information about the compromised device before exploiting CVE-2026-68820 to achieve full system control.
Targets of this campaign have been identified across various defense sectors, including surveillance sensors, drones, and robotics, in countries such as France, Germany, Brazil, and India. Previous iterations of Operation Dream Job have targeted individuals at news media organizations, domain registrars, web hosting providers, and software vendors, with fake recruiters claiming affiliations with companies like Disney, Google, and Oracle. Past compromises related to the campaign have been observed in India, Poland, the U.K., and Italy.
Experts emphasize the danger of this campaign stems not only from the zero-day vulnerability but also from the Lazarus Group's sophisticated use of legitimate infrastructure to mask their activities. They leverage real vendor branding, top-ranked search results, and compromised organizational reputations, making it difficult for targets to identify phishing attempts.
The Winsock component has been previously exploited by the Lazarus Group in 2024. The current CISA directive for federal agencies to patch the bug also follows an FBI investigation into an incident where an unidentified federal agency mistakenly hired an IT worker from North Korea, highlighting the country's ongoing efforts to infiltrate organizations globally.
