Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor

The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security flaw impacting Microsoft Windows to deliver a never-before-seen backdoor targeting defense and aerospace companies across France, Germany, Brazil, and India.
The activity, per Check Point Research, is part of Operation Dream Job, a long-running cyber espionage and social engineering campaign orchestrated by Pyongyang-backed hackers to target professionals worldwide with fake-but-compelling job offers at firms like Lockheed Martin and Enveil to steal sensitive data and install malware by approaching them on platforms like LinkedIn, pretending to be recruiters in an attempt to build trust.
The attacks have been found to exploit CVE-2026-68820 (CVSS score: 7.0), a privilege escalation flaw affecting Windows Ancillary Function Driver for WinSock ("AFD.sys") that was patched by Microsoft as part of its Patch Tuesday updates for August 2026.
Check Point Research told The Hacker News that it reported the vulnerability to Microsoft in late July 2026, although it said "we are familiar with a successful implementation of the CVE in the beginning of June."
As observed in prior campaign waves, victims are lured through bogus recruiter messages and tricked into opening a malicious PDF or installing a trojanized PDF viewer, which is then used to install a new backdoor called Troy that grants remote access to the compromised machine. The end goal of these intrusions is to seize complete control of infected computers and bypass security controls.
The use of a trojanized PDF viewer is a tried-and-tested tactic adopted by the Lazarus Group in conjunction with Dream Job, with the threat actors abusing this method as far back as 2022.
Two different parallel infection sequences have been detected as part of the latest attacks -
- DLL side-loading, in which victims are instructed to download an encrypted archive that's used to trigger a DLL side-loading chain. The malicious DLL ("libmupdf.dll") is used to display a bogus job description lure, while it stealthily downloads and executes in memory a lightweight downloader dubbed MISTPEN. The downloader communicates with threat actor-controlled infrastructure using Microsoft Graph API and OneDrive to retrieve and run reconnaissance and persistence modules and trigger the "AFD.sys" driver exploit, before deploying ForestTiger (aka ScoringMathTea), which provides remote access to the host.
- Trojanized "SecurityPDF" PDF viewer, in which victims are instructed to download SecurityPDF from a website impersonating Enveil. Once installed, it monitors for any PDF document opened through it for a special marker ("This document is encrypted with sumatrapdf reader!!!!!!!!!!!!"). If such a marker is present, the application decrypts and launches an embedded payload that's responsible for loading a backdoor called Troy directly into memory. The DLL implant supports 17 operator commands to facilitate file enumeration, upload and download, archive and exfiltration, interactive shell access, process termination, in-memory DLL injection, and configuration updates.
| High-level overview of the DLL sideloading infection chain. |
MISTPEN, for its part, loads at least four different modules -
- GetInfoPlugin ("Release_GetInfoPlugin_x64.dll"), to profile the host and exfiltrate the collected information as a single wide-character string
- PvPlugin ("Release_PvPlugin_x64.dll"), to collect host reconnaissance data and details about running processes
- OneScreenCapture ("OneScreenCapture64.dll"), to take screenshots of the current desktop, including all monitors, and transmit them as JPEG images
- LPE (local privilege escalation) loader, which gathers host information, generates new key material using the ML-KEM post-quantum key encapsulation algorithm, and uses the negotiated key during the handshake process to decrypt and run FudModule.
The attack chain employs an updated version of the known kernel-mode rootkit the Lazarus Group has repeatedly employed since at least 2022 to conceal the presence of malicious tools from security software installed on the host.
| One of websites that rank highly in search engine results for "Enveil SecurityPDF" |
Specifically, it exploits a local privilege escalation vulnerability in "AFD.sys," obtains SYSTEM privileges, and ultimately injects another instance of MISTPEN into a SYSTEM process so as to allow it to run with elevated privileges and away from the eyes of security tools. The newer version, called FudModule 3.1, improves upon its predecessor by allowing it to tamper with a Windows feature called Smart App Control designed to verify if a program is safe to run.
"Within the SYSTEM-level msiexec.exe child process, its remote stub sets VerifiedAndReputablePolicyState to zero and invokes NtSetSystemInformation class 0xA4 with option 0x10000000, triggering an in-place reload of the code integrity policy," Check Point said.
What's more, the attackers are said to have created at least three websites impersonating Enveil to distribute "SecurityPDF," although it's unclear how these fake portals were incorporated into the social engineering campaign. It's suspected that the adversary first sends the PDF through a phishing message and then urges them to download the PDF viewer from the site to view the document.
The domain names are listed below -
- envell[.]xyz
- enveil[.]online
- uxtramine[.]org
What's notable is that the campaign, instead of spinning up its own bespoke infrastructure, hijacks legitimate but compromised WordPress and SharePoint websites and vulnerable Roundcube webmail servers for use as ForestTiger command-and-control (C2) servers, thereby making it a lot more challenging to differentiate it from normal web traffic.
Many of the Roundcube servers have been found to be vulnerable to CVE-2025-49113, with the attackers leveraging it to infect them with a previously undocumented PHP web shell codenamed RelayShell to enable the exchange of commands and responses in the form of text files. In at least one case, an already breached France-based organization was used to send phishing messages to new victims to bypass reputation-based filters.
The latest findings show that Lazarus Group continues to hone its malware capabilities and tradecraft, while keeping the foundations of Dream Job largely intact in attacks aimed at critical sectors across the world.
"What makes this campaign so dangerous is not only the zero-day vulnerability – but also how Lazarus wove legitimate, trusted infrastructure into every stage of the attack," Sergey Shykevich, director of threat intelligence at Check Point Software, said in a statement shared with The Hacker News. "They hid in plain sight, behind top-ranked search results, real vendor branding, and the reputation of organizations they had already compromised.
"When the website, the download and the recruiter all appear authentic, the old advice to 'spot the phishing link' is no longer easily applicable. Staying safe now means assuming that trust itself can be counterfeited: patch the moment updates land, verify software through official channels rather than search rankings, and extend zero-trust thinking to the legitimate-looking sites and partners we interact with every day."

Facts Only

* Lazarus Group is attributed to the activity.
* The activity involves zero-day exploitation of a security flaw impacting Microsoft Windows.
* The target sectors include defense and aerospace companies in France, Germany, Brazil, and India.
* The activity is part of Operation Dream Job, a cyber espionage and social engineering campaign.
* The exploit targets CVE-2026-68820, a privilege escalation flaw in "AFD.sys."
* Infection methods include DLL side-loading via "libmupdf.dll" or using a trojanized PDF viewer called "SecurityPDF."
* One infection chain uses MISTPEN to load modules like GetInfoPlugin and OneScreenCapture64.dll.
* The attack exploits a local privilege escalation vulnerability in "AFD.sys" to obtain SYSTEM privileges.
* Attackers use compromised WordPress, SharePoint, and Roundcube servers as C2 infrastructure.
* Some Roundcube servers are vulnerable to CVE-2025-49113, allowing infection with the RelayShell web shell.
* Three websites impersonating Enveil were created to distribute "SecurityPDF."

Executive Summary

Lazarus Group is attributed to exploiting a zero-day vulnerability in Microsoft Windows affecting defense and aerospace companies in France, Germany, Brazil, and India. This activity is part of Operation Dream Job, a campaign involving cyber espionage and social engineering to steal data through fake job offers. The attackers exploit CVE-2026-68820, a privilege escalation flaw in the Windows Ancillary Function Driver for WinSock ("AFD.sys"). Infection sequences involve either DLL side-loading via a malicious DLL named "libmupdf.dll" using a downloader called MISTPEN or the installation of a trojanized PDF viewer named "SecurityPDF." The latter allows for backdoor installation via the Troy payload, which provides remote access, often utilizing a local privilege escalation exploit in AFD.sys to gain SYSTEM privileges. Attackers leverage compromised legitimate websites, such as WordPress and Roundcube servers, as Command and Control (C2) infrastructure, including exploiting CVE-2025-49113 on some servers.

Full Take

The persistence of this campaign relies on weaving legitimate trust signals into the attack methodology, transforming standard social engineering tactics into highly effective vectors. The core danger lies not just in exploiting a technical flaw like CVE-2026-68820, but in the operational camouflage achieved by leveraging existing infrastructure. By hijacking compromised WordPress and webmail servers for C2 functions, the threat actors effectively bypass traditional network-based detection systems that focus on external malicious IPs or novel signatures. This creates an environment where legitimate activity masks illicit control, which is precisely what Sergey Shykevich describes as hiding "in plain sight." The use of vendor branding and high-ranking search results to distribute malware amplifies this illusion, shifting the burden of security from technical vigilance to pervasive skepticism regarding all digital interactions. The pattern demonstrates a shift in adversary focus: from purely novel exploit development to sophisticated infrastructure camouflage built atop known, trusted systems. This implies that defensive strategies must evolve beyond patching vulnerabilities to scrutinizing the integrity and provenance of seemingly legitimate web assets and partner relationships.
Bridge Questions: If trust itself is counterfeited, what verifiable, independent verification mechanisms can organizations implement to assess the authenticity of digital partners? How can security frameworks effectively model and defend against multi-stage attacks where C2 infrastructure is deliberately seeded within legitimate, high-reputation environments? What is the long-term impact on human cognitive resilience when digital trust is systematically eroded through such sophisticated camouflage?

Sentinel — Human

Confidence

This text reads as detailed threat intelligence reporting, skillfully weaving specific exploit details with strategic context, making it highly likely to be human-authored expert analysis rather than pure synthetic generation.

Signals Detected

Moderate sentence length variance; sophisticated but specific technical terminology integrated naturally.

Strong internal logical flow tracing attack vectors from initial exploit to C2 infrastructure.

Detailed breakdown of infection chains and technical components suggests deep source knowledge, not mere aggregation.

Specific CVE numbers (CVE-2026-68820) and detailed process descriptions point to specific threat intelligence reports.

Human Indicators

The inclusion of highly specific, layered technical details regarding malware chains (MISTPEN, Troy, libmupdf.dll) alongside strategic implications suggests domain expertise characteristic of threat intelligence reporting.

The final quote from Sergey Shykevich provides a high-level philosophical summation that bridges the technical findings with actionable cognitive sovereignty advice, which often distinguishes human analysis.