The North Korean advanced persistent threat (APT) group known as Lazarus has been observed leveraging a previously unknown Windows zero-day vulnerability, identified as CVE-2026-68820, in a new iteration of their long-running "Operation Dream Job" campaign. This campaign specifically targets professionals in the defense and aerospace sectors with deceptive job offers, often impersonating legitimate companies like Lockheed Martin.
Check Point Research, which uncovered the campaign, reported the vulnerability to Microsoft on July 28, with Microsoft confirming the issue three days later. A fix for CVE-2026-68820, a privilege escalation flaw in the AFD.sys kernel driver, was subsequently released by Microsoft on August 11 as part of its monthly Patch Tuesday updates. This vulnerability allows attackers to gain full control over infected systems and evade endpoint detection and response (EDR) visibility.
The current phase of Operation Dream Job employs two distinct infection chains. In the first, victims download an encrypted archive containing a legitimate, signed PDF viewer bundled with a malicious DLL. This DLL displays a convincing job description while silently deploying MISTPEN, a lightweight downloader that uses Microsoft Graph API and OneDrive for communication. MISTPEN then conducts reconnaissance, exploits the AFD.sys vulnerability to achieve SYSTEM privileges, and installs ForestTiger, a known Lazarus backdoor, along with an updated version of the FudModule 3.1 kernel-mode rootkit. FudModule 3.1 now includes capabilities to tamper with Windows Smart App Control, bypassing software verification.
The second infection chain, which shares characteristics with a 2025 campaign against the UAV sector, instructs victims to download a trojanized PDF viewer named SecurityPDF. This software is distributed from websites impersonating Enveil, a legitimate privacy technology company that has no actual connection to the attacks. When a PDF with a hidden marker is opened through this modified viewer, an embedded payload is decrypted and launched, loading the Troy backdoor directly into memory. Troy is a DLL implant supporting 17 operator commands for file operations, shell access, process termination, in-memory DLL injection, and configuration updates. Its name is derived from a PDB path found in the binary, which Check Point has also observed in earlier Lazarus samples.
The command and control (C2) infrastructure for this campaign is built almost entirely from compromised legitimate servers, rather than attacker-controlled infrastructure. This includes Roundcube webmail installations and WordPress sites, many of which were vulnerable to CVE-2025-49113 or compromised through leaked credentials. These compromised servers are infected with a previously undocumented PHP webshell called RelayShell, which acts as a relay for commands and responses through simple text files. Check Point identified at least 17 unique server identifiers within this relay network, with operators using commercial VPNs to mask their locations. In at least one instance, a previously breached French organization was used to send phishing messages to new targets, leveraging its reputation to bypass security filters.
Confirmed targets of this campaign have been identified in France, Germany, Brazil, and India. Security teams in the defense and aerospace sectors are strongly advised to prioritize applying the August 2026 Patch Tuesday update to address CVE-2026-68820. Organizations operating public-facing Roundcube or CMS installations should also review their systems for vulnerabilities and potential compromise, as they risk becoming part of the attackers' relay infrastructure. Furthermore, organizations should exercise extreme caution with unsolicited recruiting outreach and treat any unverified download requests with the same level of scrutiny as other potential threats.
