North Korean state-sponsored hackers, identified as the Lazarus Group, have been exploiting a Windows zero-day vulnerability, designated CVE-2026-68820, as part of their ongoing Operation Dream Job campaign. The vulnerability, a use-after-free flaw in the Windows Ancillary Function Driver for WinSock (AFD.sys), allows for local privilege escalation. Microsoft confirmed the active exploitation of this flaw and issued a patch in its August 2026 Patch Tuesday security updates.
The Lazarus Group has been leveraging CVE-2026-68820 since early July, primarily targeting defense, aerospace, and aviation organizations in Europe and India. The attack chain typically begins with fraudulent recruitment offers, a hallmark of the Operation Dream Job campaign, aimed at employees within these critical sectors. In at least one instance, the threat actors compromised a French organization and subsequently used it as a platform for spear-phishing attacks against additional targets.
Cybersecurity researchers observed that the Lazarus Group integrated an exploit for CVE-2026-68820 into a new version of their FudModule kernel-mode rootkit. This exploit specifically targets Windows 11 builds 26100 and 26200, enabling the attackers to achieve SYSTEM privileges without user interaction by triggering a race condition through a specially crafted application. This is not the first time Lazarus has exploited an AFD.sys zero-day to install the FudModule rootkit.
The updated FudModule rootkit retains previously documented capabilities, such as disabling Endpoint Detection and Response (EDR) telemetry and interfering with security products. It also introduces new functionality, including tampering with Smart App Control. Beyond the rootkit, the hackers have deployed a new backdoor named Troy, which supports 17 commands. These commands facilitate system and process reconnaissance, file manipulation (upload, download, deletion, archive-based exfiltration), hidden command execution, remote process termination, in-memory DLL injection, and configuration and beacon timing adjustments.
In addition to the Windows zero-day exploitation, researchers also observed the Lazarus Group scanning for and compromising vulnerable Roundcube installations. The attackers likely used leaked credentials to authenticate to Roundcube before exploiting CVE-2025-49113, an authenticated PHP object-deserialization vulnerability, to achieve remote code execution. Following successful exploitation, a new PHP web shell, dubbed RelayShell, was deployed. At least 17 servers infected with RelayShell have been identified.
The latest iteration of Operation Dream Job has a strong focus on the defense sector, particularly organizations involved in military technologies suchs as surveillance sensors, drones, and robotics. While successful targeting has been observed in Western Europe, including France and Germany, the campaign's reach extends globally, with activity noted in South America, specifically Brazil.
The group's tactics demonstrate an evolution toward stealthier operations, adapting to targeted environments. This includes the abuse of legitimate web infrastructure, such as compromised Roundcube instances, to obscure malicious communications. Indicators of compromise and a YARA rule for detecting the RelayShell webshell have been made available to aid in defense against these attacks.
