The North Korea-linked Lazarus Group has been observed employing a Windows zero-day exploit in a new phase of its "Operation Dream Job" campaign, primarily targeting the defense sector. The campaign leverages fake job offers and trojanized PDF software to compromise systems, ultimately deploying a kernel-mode rootkit and a new backdoor.
Researchers identified two distinct infection chains. In the first, victims are lured to download an encrypted ZIP archive containing a legitimate, digitally signed PDF viewer executable, a malicious DLL (libmupdf.dll), and an encrypted payload. When the executable is launched, the malicious DLL is sideloaded, displaying a decoy PDF document while simultaneously extracting and executing an embedded payload in memory. This payload, identified as MISTPEN, is an in-memory downloader that profiles the compromised system and retrieves additional components.
One of these components exploits CVE-2026-68820, a local privilege escalation vulnerability in the Windows AFD.sys driver. Successful exploitation grants the attackers SYSTEM privileges, enabling the deployment of FudModule, a Lazarus kernel-mode rootkit designed to interfere with security monitoring. Researchers confirmed the exploit's effectiveness against an updated Windows 11 system and determined it targeted a previously unknown vulnerability active since at least early July. Microsoft subsequently patched CVE-2026-68820 on August 11, 2026, as part of its monthly Patch Tuesday updates.
The second infection chain, detected in July, involved attackers impersonating the privacy technology company Enveil. Targets received fraudulent job offers and were instructed to download "SecurityPDF," a modified open-source PDF viewer. When an attacker-crafted PDF is opened with SecurityPDF, the application extracts and executes an embedded payload, installing "Troy," a newly documented backdoor that provides remote access to the compromised system. The attackers created at least three websites impersonating Enveil to distribute SecurityPDF, some of which ranked highly in search results. There is no indication that Enveil itself was targeted or compromised.
While the initial approach to victims was not directly observed, researchers assess that Lazarus likely contacted targets through professional networking platforms like LinkedIn or messaging applications, consistent with previous Dream Job operations. Decoy documents included job descriptions from companies such as Lockheed Martin. In the scenario involving SecurityPDF, victims likely received a malicious PDF file via a phishing message and were later instructed to download the viewer from what appeared to be a legitimate vendor website.
Beyond direct victim compromise, Lazarus also compromised Roundcube webmail and other web servers to relay command-and-control traffic. Several compromised Roundcube servers were running versions vulnerable to CVE-2025-49113. Researchers believe stolen credentials may have been used to authenticate to these servers before exploiting the vulnerability and deploying RelayShell, a previously undocumented PHP web shell.
The campaign's focus has primarily been on organizations in Western Europe and India, with activity extending to South America. In one instance, an organization headquartered in France was compromised and used to send spear-phishing messages to additional targets. This latest iteration of Operation Dream Job demonstrates the Lazarus Group's continued evolution in both malware capabilities and operational tradecraft.
