Lazarus Exploits CVE-2026-68820 Zero-Day via Malicious PDF Viewer in Operation Dream Job Against Defense Industry

Key facts

Detection coverage

As of 2026-09-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2561 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Operation Dream Job — Trojanized SecurityPDF Viewer / libmupdf.dll DLL Side-Load Delivery

Detects the initial delivery stage of Lazarus's Operation Dream Job defense-industry campaign: execution of the trojanized 'SecurityPDF' viewer or side-loading of libmupdf.dll from a non-standard path, or file drops matching known dropper/installer SHA256 hashes distributed via fake Lockheed Martin/Enveil recruiter lures on envell.xyz, enveil.online, and uxtramine.org.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.002, T1204.002, T1574.002
• Data sources: sysmon, windows_security, edr_image_load
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=7 OR EventCode=11)
| where (EventCode=7 AND ImageLoaded="*\\libmupdf.dll" AND NOT ImageLoaded="*\\Program Files\\*")
   OR (EventCode=1 AND (Image="*\\SecurityPDF.exe" OR CommandLine="*SecurityPDF*"))
   OR (EventCode=11 AND Hashes IN ("SHA256=2b4987c07a3d9a9a5d1a9bf4efa3d1903e775090b611710edafdc92874265ca8","SHA256=3a02d0d798e8d35555776886d92b20ff38a101c9ef7e0eebc8ce5d259516525a","SHA256=743172aab606974b054a64561534ae66baa3a840657f79d7c6fa18350e8d45d1","SHA256=db3d69b7eeda2e35e23006bf4b7e206281fce809584207214fc213f9bc30376d"))
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as image values(CommandLine) as cmdline values(ImageLoaded) as loaded_dll values(TargetFilename) as dropped_file by ComputerName, User, EventCode
| where count > 0

Microsoft KQL

DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FileName =~ "libmupdf.dll" and FolderPath !contains @"\Program Files"
| project Timestamp, DeviceName, InitiatingProcessAccountName=AccountName, InitiatingProcessFileName, FileName, FolderPath, SHA256
| union (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where SHA256 in ("2b4987c07a3d9a9a5d1a9bf4efa3d1903e775090b611710edafdc92874265ca8","3a02d0d798e8d35555776886d92b20ff38a101c9ef7e0eebc8ce5d259516525a","743172aab606974b054a64561534ae66baa3a840657f79d7c6fa18350e8d45d1","db3d69b7eeda2e35e23006bf4b7e206281fce809584207214fc213f9bc30376d")
    | project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FileName, FolderPath, SHA256
)
| sort by Timestamp desc

Sigma

title: Lazarus libmupdf.dll DLL Side-Load — SecurityPDF/MISTPEN Delivery
id: 1a2b3c4d-5e6f-4789-9abc-def012345001
status: experimental
description: Detects libmupdf.dll being side-loaded from a non-standard path by a SecurityPDF-branded process, the delivery mechanism for the Lazarus Operation Dream Job MISTPEN downloader chain.
references:
    - https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/
author: Threadlinqs Team
date: 2026/09/18
tags:
    - attack.initial-access
    - attack.t1566.002
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1574.002
    - attack.group.lazarus
    - attack.tool.mistpen
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\libmupdf.dll'
    filter_legit:
        ImageLoaded|contains: '\Program Files\'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate MuPDF-based PDF viewers installed under Program Files; this rule excludes that path
level: high

Known false positives:

• Legitimate MuPDF-based PDF viewer installations under Program Files that happen to ship libmupdf.dll — excluded by the path filter, but verify vendor signing on any hit outside it

Tuning notes: Add an allowlist of signed, vendor-approved PDF viewer install paths per fleet; tighten the hash list as Check Point/AhnLab publish additional SecurityPDF installer variants.

• 🔒 MISTPEN Downloader Dead-Drop C2 via Microsoft Graph API/OneDrive · unlock with TL Creds
• 🔒 FudModule v3.1 Smart App Control Policy Zeroing (VerifiedAndReputablePolicyState) · unlock with TL Creds
• 🔒 Outbound Connection to Operation Dream Job C2 or OSINT-Corroborated DPRK Sibling Infrastructure · unlock with TL Creds
• 🔒 SecurityPDF Trojanized Viewer XOR Payload Extraction Dropping Troy via new.exe · unlock with TL Creds
• 🔒 FudModule v3.1 SYSTEM msiexec.exe Anomalous Child Process Spawn · unlock with TL Creds
• 🔒 Troy Backdoor Post-Exploitation Discovery and Shell Command Execution · unlock with TL Creds
• 🔒 afd.sys CVE-2026-68820 Exploitation / FudModule v3.1 SYSTEM-Context msiexec.exe Chain · unlock with TL Creds
• 🔒 Troy Backdoor C2 Handshake / MISTPEN Dead-Drop / RelayShell Relay Traffic · unlock with TL Creds

Indicators of compromise

As of 2026-09-18, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-2561.

Sample indicators (3 of 29)

• IP address: 135.181.67[.]203
• Domain: envell[.]xyz
• File hash: 2b4987c07a3d9a9a5d1a9bf4efa3d1903e775090b611710edafdc92874265ca8

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

Technical analysis

AhnLab ASEC's August 2026 APT trend report independently confirms Lazarus's use of a malicious PDF viewer plus a pre-disclosure zero-day against the defense industry.

Since early 2026, Check Point Research tracked a wave of the DPRK-linked Lazarus Group's long-running Operation Dream Job campaign focused on defense, aerospace, and aviation organizations across Western Europe (France, Germany), India, and, secondarily, Brazil. The operation used fraudulent recruiter outreach on LinkedIn and messaging platforms impersonating Lockheed Martin and the privacy-enhancing-technology firm Enveil, directing targets to lookalike websites (envell.xyz, enveil.online, uxtramine.org) that were promoted via search-engine-optimization (SEO) poisoning to rank highly for terms like "Enveil SecurityPDF."

Two parallel infection chains were used. The first delivered an encrypted ZIP containing a legitimate PDF viewer alongside a malicious DLL (libmupdf.dll) that side-loads, displays a decoy job-description PDF, and launches the in-memory MISTPEN downloader, which retrieves further modules via the Microsoft Graph API/OneDrive as a covert C2 channel and can deploy the ForestTiger (aka ScoringMathTea) backdoor. The second chain distributed a trojanized "SecurityPDF" viewer (built on the MuPDF framework) that watches File->Open and drag-and-drop actions for a marker string embedded in crafted PDFs ("This document is encrypted with sumatrapdf reader!!!!!!!!!!!!!!"), then extracts an embedded payload with a single-byte XOR key (0x39), writes it to %TEMP%\new.exe, and reflectively loads the Troy backdoor -- a 64-bit modular RAT with 17 operator commands covering file operations, an interactive shell, process enumeration, and in-memory DLL injection.

Both chains converge on privilege escalation via CVE-2026-68820, a use-after-free (CWE-416) in the Windows Ancillary Function Driver for WinSock (afd.sys), triggered by a race condition when a socket is accessed concurrently by multiple threads without synchronization, corrupting freed memory to obtain kernel read/write primitives on Windows 11 builds 26100 (24H2) and 26200 (25H2). Check Point observed successful in-the-wild exploitation as early as June 2026, reported the flaw to Microsoft on July 28, 2026; Microsoft confirmed it July 31, assigned CVE-2026-68820 on August 5, and shipped a fix on August 11 -- meaning Lazarus ran the exploit for at least five weeks pre-patch. The exploit deploys FudModule v3.1, a kernel-mode rootkit that retains v3's ETW provider killlist (94 GUIDs), crash-dump suppression, WFP staging, and privileged-handle forgery, and adds tampering with Windows Smart App Control (zeroing VerifiedAndReputablePolicyState via NtSetSystemInformation class 0xA4) and code-integrity policy reload inside a SYSTEM-context msiexec.exe.

C2 and exfiltration infrastructure relied on compromised, legitimately-owned web servers rather than actor-owned hosts: a previously undocumented PHP webshell, RelayShell, was deployed on hijacked Roundcube webmail instances (many vulnerable to CVE-2025-49113, an unauthenticated-adjacent PHP object-deserialization RCE), as well as compromised WordPress and SharePoint sites, acting as dual-mode (victim/operator) relay nodes using file-based message-passing. Seventeen unique RelayShell identifiers were observed; operators connected via commercial VPN (ExpressVPN) services. Troy's own C2 protocol validates a "CONNECTED" handshake string and exchanges base64-encoded, JSON-wrapped commands, while MISTPEN's LPE loader module generates ML-KEM (Kyber) post-quantum asymmetric key material to secure its channel. At least one compromised French defense-sector organization was repurposed as launch infrastructure for further spear-phishing.

Check Point attributes the campaign to Lazarus with high confidence based on TTP overlap, malware family reuse, and PDB paths referencing "Troy." AhnLab ASEC's separately published August 2026 APT group trend report corroborates the core finding -- Lazarus combining a malicious PDF viewer with a zero-day exploited before public disclosure in Operation Dream Job attacks against the defense industry -- without providing additional IOCs beyond what Check Point, The Hacker News, and Help Net Security had already documented.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1014 Rootkit; T1574.001 DLL; T1620 Reflective Code Loading

Persistence

T1053.005 Scheduled Task

Discovery

T1057 Process Discovery; T1082 System Information Discovery

Command and Control

T1071.001 Web Protocols; T1573.002 Asymmetric Cryptography

Collection

T1113 Screen Capture

Execution

T1204.002 Malicious File

Initial Access

T1566.002 Spearphishing Link

Resource Development

T1583.001 Domains; T1584.004 Server; T1608.006 SEO Poisoning

defense-impairment

T1685 Disable or Modify Tools

Remediation

Patches

• Microsoft August 2026 Patch Tuesday cumulative update resolving CVE-2026-68820 (afd.sys use-after-free)
• Roundcube Webmail 1.5.10 or 1.6.11 resolving CVE-2025-49113 (PHP object deserialization RCE)

Immediate actions

• Apply the August 2026 Patch Tuesday update addressing CVE-2026-68820 immediately; CISA KEV lists a required remediation due date of 2026-08-25 under BOD 26-04
• Block the identified C2/distribution domains (envell.xyz, enveil.online, uxtramine.org) and IPs (135.181.67.203, 135.181.185.158) at the perimeter and DNS layer
• Hunt for and remove the identified DLL loader, MISTPEN, ForestTiger, FudModule, Troy, and RelayShell file hashes across Windows endpoints and internet-facing web servers
• Patch Roundcube Webmail to 1.5.10+ or 1.6.11+ to close CVE-2025-49113 and audit for unauthorized PHP webshells on any exposed webmail, WordPress, or SharePoint hosts

Workarounds

• Where immediate patching is not possible, apply CISA BOD 26-04 mitigation and forensic-triage guidance and restrict local logon on exposed Windows 11 24H2/25H2 hosts
• Block execution of unsigned or unexpected PDF-viewer installers obtained from non-standard/non-vendor download sources

Longer-term hardening

• Deploy EDR/XDR with kernel-level, ETW-tamper-resistant telemetry capable of detecting FudModule-class rootkit behavior (ETW provider suppression, crash-dump suppression, Smart App Control tampering)
• Train defense, aerospace, and aviation personnel to verify recruiter identities out-of-band before downloading any "security" software promoted via LinkedIn/messaging-platform job offers
• Monitor for SEO-poisoned lookalike domains impersonating employer or vendor brand names used in recruitment lures
• Restrict, log, and alert on outbound Microsoft Graph API/OneDrive traffic from endpoints not associated with sanctioned productivity workflows, given its use as a dead-drop C2 channel

Affected and fixed versions

• Microsoft — Windows Ancillary Function Driver for WinSock (afd.sys)
  Vulnerable versions: Windows 11 24H2 (build 26100); Windows 11 25H2 (build 26200); Windows 10; Windows Server 2012-2025
  Fixed in: August 2026 Patch Tuesday cumulative update
• Roundcube — Roundcube Webmail
  Vulnerable versions: < 1.5.10; 1.6.x < 1.6.11
  Fixed in: 1.5.10; 1.6.11

Timeline

• 2026-01-01 Check Point Research begins tracking a new wave of Operation Dream Job primarily targeting defense, aerospace, and aviation organizations worldwide (reported as "since early 2026").
• 2026-06-01 Check Point Research confirms successful in-the-wild implementation of the CVE-2026-68820 afd.sys exploit by Lazarus.
• 2026-07-01 Independent reporting places sustained active exploitation of the afd.sys zero-day from early July 2026, continuing until the August patch -- Lazarus ran the exploit for at least five weeks before a fix was available.
• 2026-07-28 Check Point Research reports the afd.sys use-after-free vulnerability to the Microsoft Security Response Center (MSRC).
• 2026-07-31 Microsoft confirms the reported vulnerability.
• 2026-08-05 CVE-2026-68820 is officially assigned to the Windows afd.sys use-after-free privilege-escalation vulnerability.
• 2026-08-11 Microsoft releases a fix for CVE-2026-68820 in the August 2026 Patch Tuesday update; CISA adds the CVE to the Known Exploited Vulnerabilities catalog the same day with a remediation due date of 2026-08-25.
• 2026-08-12 Check Point Research, The Hacker News, and Help Net Security publicly disclose the Operation Dream Job zero-day campaign, detailing the SecurityPDF trojanized viewer, Troy backdoor, MISTPEN downloader, and FudModule v3.1 rootkit.
• 2026-09-18 AhnLab ASEC's August 2026 APT group trend report references Lazarus's use of a malicious PDF viewer and a zero-day (CVE-2026-68820) exploited before public disclosure in Operation Dream Job attacks against the defense industry.

Sources cited

• CVE-2026-68820 Detail NVD (NIST) · Advisory · 2026-08-11
• CISA Known Exploited Vulnerabilities Catalog - CVE-2026-68820 CISA · Government advisory · 2026-08-11
• 2026년 8월 APT 그룹 동향 보고서 (August 2026 APT Group Trend Report) asec.ahnlab.com · Research · 2026-09-18
• Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack Check Point Research · Research · 2026-08-12
• Microsoft Security Update Guide - CVE-2026-68820 Microsoft Security Response Center · Vendor report · 2026-08-11
• Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor The Hacker News · News · 2026-08-12
• Lazarus hackers pair fake job offers with Windows zero-day exploit Help Net Security · News · 2026-08-12
• Over 84,000 Roundcube instances vulnerable to actively exploited flaw BleepingComputer · News · 2026-02-20

More in zero day

• Autonomous AI Agent Sandbox Escape via JFrog Artifactory Zero-Days and Hugging Face Dataset Pipeline Intrusion (OpenAI ExploitGym Incident)
• Citrix NetScaler ADC/Gateway Zero-Day CVE-2026-88779 ("PitScaler 2") Exploited Against Appliances Patched Days Earlier (CISA KEV)
• Vercel Confirms KVM Zero-Day Guest-to-Host VM Escape (Root on Host) via Sandbox Bug Bounty; $50,000 Bounty Awarded
• Fortinet FortiMail critical path traversal flaw CVE-2026-104286 (FG-IR-26-175) exploited in zero-day attacks
• Kiteworks Urges Customers to Shut Down Systems After Federal Threat Intelligence Warning of Possible Zero-Day Attack

More from Lazarus Group

• North Korean Lazarus (Operation DreamJob) and DeceptiveDevelopment Target Drone Technology and Software Supply Chains
• North Korea-aligned Lazarus Targets Drone Sector (ScoringMathTea via BinMergeLoader) and DeceptiveDevelopment Targets Software Repositories (ESET APT Activity Report Q2-Q3 2026)
• The Mac Malware of 2023: macOS Ransomware, Stealers, and DPRK/Iran-Linked APT Malware (Objective-See Annual Review)
• North Korean Threat Actors Operationalize AI Across Tradecraft (Jade/Coral/Jasper/Diamond/Onyx/Pearl/Sapphire/Emerald Sleet; ProcmacSteal)
• NSFOCUS Monthly APT Insights August 2026: Lazarus MISTPEN/ForestTiger/RelayShell Campaign with CVE-2026-68820, UAC-0099 LUNCHPOKE/BURNYBEAR/MATCHBOIL.V2, CVE-2026-42897 Exchange OWA Exploitation
• Operation FlashHole: Lazarus watering-hole and spear-phishing campaign abusing INISAFE CrossWeb EX against South Korean organizations

Other reports on CVE-2026-68820

• Microsoft August 2026 Patch Tuesday: 400 Flaws Fixed, Including Lazarus-Exploited Zero-Day CVE-2026-68820 (AFD.sys) and Two Publicly Disclosed Zero-Days (CVE-2026-62832 "LegacyHive", CVE-2026-72971)

Other reports on CVE-2025-49113

• Rapid7 Q3 2026 Threat Landscape: High-Severity Flaws Exploited in 3 Days as The Gentlemen and Qilin Ransomware Dominate
• Operation RoundPress: TA458 Deploys SpyPress Malware via Half-Click Webmail Zero-Days (CVE-2025-27915, CVE-2025-3929, CVE-2026-8496)
• UNK_MassTraction Exploits Roundcube XSS/Deserialization Flaws (CVE-2024-42009, CVE-2025-49113) to Spy on Academic Researchers
• RoundCube Webmail Active Exploitation — CVE-2025-49113 Deserialization RCE (CVSS 9.9) + CVE-2025-68461 XSS via SVG Animate Tag (CISA KEV)

Previous and next in zero day

• Kiteworks Urges Global Customers to Shut Down Servers for 6-9 Hours Over Federally-Warned Potential Zero-Day Targeting Next report