The North Korean-backed Lazarus Group has been observed deploying a Windows zero-day exploit, CVE-2026-68820, using a command channel secured with a post-quantum key exchange mechanism. This activity is part of the ongoing "Operation Dream Job" campaign, which targets employees at defense and aerospace companies in Europe and India with fraudulent job offers.
The vulnerability, a use-after-free race condition in the `AFD.sys` driver, which handles network sockets in the Windows kernel, was reported to Microsoft on July 28 and subsequently patched on August 11. Microsoft confirmed that this was the only flaw in its August Patch Tuesday release that was under active exploitation.
The attack chain begins with an in-memory downloader named MISTPEN, which communicates via attacker-controlled files on OneDrive using the Microsoft Graph API. After initial reconnaissance and establishing persistence, MISTPEN loads a dedicated module to fetch the privilege escalation exploit. This module first fingerprints the victim's host, then requests four public keys from the command server. It utilizes these keys to generate new key material with Kyber/ML-KEM, a key encapsulation scheme standardized by NIST in 2024 for its resistance to quantum computer attacks. The encapsulated result is then returned to the server before the exploit itself is requested, decrypted, and executed in memory.
The command channel traffic is secured with multiple layers of encryption. In addition to MISTPEN's AES transport encryption, a second layer using GOST-CBC is applied, followed by the post-quantum key exchange. The exploit delivered through this handshake is FudModule, Lazarus's kernel rootkit, specifically version 3.1. This rootkit is designed to disable telemetry callbacks, remove minifilters, terminate the NT Kernel Logger, and blind 94 Event Tracing for Windows (ETW) providers. A newly identified capability of FudModule is its ability to tamper with Smart App Control, resetting its policy state and forcing a code integrity reload.
Lazarus Group's infrastructure for this campaign relies heavily on compromised third-party servers. They have utilized Roundcube webmail servers, likely exploited via CVE-2025-49113 using credentials obtained from dark web leaks, as well as compromised PrestaShop sites. These servers host RelayShell, a previously undocumented PHP webshell that functions as a message relay between the operator and victim through session files, rather than a conventional command shell. Evidence suggests at least 17 such relay servers have been compromised.
The initial delivery methods have also evolved. The group created at least three websites impersonating the privacy technology vendor Enveil, some of which ranked highly in search results. It is important to note that Enveil was neither targeted nor compromised in this operation. These deceptive websites distributed a trojanized PDF viewer containing a payload hidden within crafted documents. This payload delivers Troy, a previously undocumented backdoor that supports 17 operator commands. The targeting for Operation Dream Job has included organizations involved in surveillance sensors, drones, and robotics, with observed activity or targeting in France, Germany, Brazil, and India.
