Lazarus Exploits CVE-2026-68820 Zero-Day via Malicious PDF Viewer in Operation Dream Job Against Defense Industry
Lazarus Exploits CVE-2026-68820 Zero-Day via Malicious PDF (TL-2026-2561), also tracked as Operation Dream Job, is a critical-severity zero-day vulnerability scored CVSS 7, first published 2026-09-18. It is attributed to Lazarus Group (North Korea) with high confidence, affects Microsoft Windows Ancillary Function Driver for WinSock (afd.sys), references 2 CVEs (CVE-2026-68820, CVE-2025-49113), maps to 15 MITRE ATT&CK techniques (T1014, T1053.005, T1057), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-2561
- Threat ID
- TL-2026-2561
- Also known as
- Operation Dream Job
- Severity
- CRITICAL
- CVSS
- 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- ZERO_DAY
- First published
- 2026-09-18
- Last reviewed
- 2026-09-18
- Attribution
- Lazarus Group
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- ESPIONAGE
- Target sectors
- defense, aerospace, aviation
- Target regions
- Europe, france, germany, india, brazil
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Lazarus Exploits CVE-2026-68820 Zero-Day via Malicious PDF
Malware and tooling: ForestTiger, FudModule, MISTPEN, RelayShell, SecurityPDF, Troy, ExpressVPN
Lazarus Group ran a wave of Operation Dream Job against defense, aerospace, and aviation organizations in Europe, India, and Brazil, using fake job offers impersonating Lockheed Martin and Enveil to deliver a trojanized "SecurityPDF" viewer and a DLL-sideloading chain that exploited an afd.sys use-after-free zero-day (CVE-2026-68820) to gain SYSTEM access via the FudModule v3.1 rootkit. AhnLab ASEC's August 2026 APT trend report independently confirms Lazarus's use of a malicious PDF viewer plus a pre-disclosure zero-day against the defense industry.
How Lazarus Exploits CVE-2026-68820 Zero-Day via Malicious PDF works
Since early 2026, Check Point Research tracked a wave of the DPRK-linked Lazarus Group's long-running Operation Dream Job campaign focused on defense, aerospace, and aviation organizations across Western Europe (France, Germany), India, and, secondarily, Brazil. The operation used fraudulent recruiter outreach on LinkedIn and messaging platforms impersonating Lockheed Martin and the privacy-enhancing-technology firm Enveil, directing targets to lookalike websites (envell.xyz, enveil.online, uxtramine.org) that were promoted via search-engine-optimization (SEO) poisoning to rank highly for terms like "Enveil SecurityPDF."
Two parallel infection chains were used. The first delivered an encrypted ZIP containing a legitimate PDF viewer alongside a malicious DLL (libmupdf.dll) that side-loads, displays a decoy job-description PDF, and launches the in-memory MISTPEN downloader, which retrieves further modules via the Microsoft Graph API/OneDrive as a covert C2 channel and can deploy the ForestTiger (aka ScoringMathTea) backdoor. The second chain distributed a trojanized "SecurityPDF" viewer (built on the MuPDF framework) that watches File->Open and drag-and-drop actions for a marker string embedded in crafted PDFs ("This document is encrypted with sumatrapdf reader!!!!!!!!!!!!!!"), then extracts an embedded payload with a single-byte XOR key (0x39), writes it to %TEMP% ew.exe, and reflectively loads the Troy backdoor -- a 64-bit modular RAT with 17 operator commands covering file operations, an interactive shell, process enumeration, and in-memory DLL injection.
Both chains converge on privilege escalation via CVE-2026-68820, a use-after-free (CWE-416) in the Windows Ancillary Function Driver for WinSock (afd.sys), triggered by a race condition when a socket is accessed concurrently by multiple threads without synchronization, corrupting freed memory to obtain kernel read/write primitives on Windows 11 builds 26100 (24H2) and 26200 (25H2). Check Point observed successful in-the-wild exploitation as early as June 2026, reported the flaw to Microsoft on July 28, 2026; Microsoft confirmed it July 31, assigned CVE-2026-68820 on August 5, and shipped a fix on August 11 -- meaning Lazarus ran the exploit for at least five weeks pre-patch. The exploit deploys FudModule v3.1, a kernel-mode rootkit that retains v3's ETW provider killlist (94 GUIDs), crash-dump suppression, WFP staging, and privileged-handle forgery, and adds tampering with Windows Smart App Control (zeroing VerifiedAndReputablePolicyState via NtSetSystemInformation class 0xA4) and code-integrity policy reload inside a SYSTEM-context msiexec.exe.
C2 and exfiltration infrastructure relied on compromised, legitimately-owned web servers rather than actor-owned hosts: a previously undocumented PHP webshell, RelayShell, was deployed on hijacked Roundcube webmail instances (many vulnerable to CVE-2025-49113, an unauthenticated-adjacent PHP object-deserialization RCE), as well as compromised WordPress and SharePoint sites, acting as dual-mode (victim/operator) relay nodes using file-based message-passing. Seventeen unique RelayShell identifiers were observed; operators connected via commercial VPN (ExpressVPN) services. Troy's own C2 protocol validates a "CONNECTED" handshake string and exchanges base64-encoded, JSON-wrapped commands, while MISTPEN's LPE loader module generates ML-KEM (Kyber) post-quantum asymmetric key material to secure its channel. At least one compromised French defense-sector organization was repurposed as launch infrastructure for further spear-phishing.
Check Point attributes the campaign to Lazarus with high confidence based on TTP overlap, malware family reuse, and PDB paths referencing "Troy." AhnLab ASEC's separately published August 2026 APT group trend report corroborates the core finding -- Lazarus combining a malicious PDF viewer with a zero-day exploited before public disclosure in Operation Dream Job attacks against the defense industry -- without providing additional IOCs beyond what Check Point, The Hacker News, and Help Net Security had already documented.
MITRE ATT&CK techniques used in TL-2026-2561
Defense Evasion
T1014 Rootkit; T1574.001 DLL; T1620 Reflective Code Loading
Persistence
Discovery
T1057 Process Discovery; T1082 System Information Discovery
Command and Control
T1071.001 Web Protocols; T1573.002 Asymmetric Cryptography
Collection
Execution
Initial Access
Resource Development
T1583.001 Domains; T1584.004 Server; T1608.006 SEO Poisoning
defense-impairment
Affected products and versions in Lazarus Exploits CVE-2026-68820 Zero-Day via Malicious PDF
- Microsoft — Windows Ancillary Function Driver for WinSock (afd.sys)
Vulnerable versions: Windows 11 24H2 (build 26100); Windows 11 25H2 (build 26200); Windows 10; Windows Server 2012-2025
Fixed in: August 2026 Patch Tuesday cumulative update - Roundcube — Roundcube Webmail
Vulnerable versions: < 1.5.10; 1.6.x < 1.6.11
Fixed in: 1.5.10; 1.6.11
Remediation for Lazarus Exploits CVE-2026-68820 Zero-Day via Malicious PDF
Patches
- Microsoft August 2026 Patch Tuesday cumulative update resolving CVE-2026-68820 (afd.sys use-after-free)
- Roundcube Webmail 1.5.10 or 1.6.11 resolving CVE-2025-49113 (PHP object deserialization RCE)
Immediate actions
- Apply the August 2026 Patch Tuesday update addressing CVE-2026-68820 immediately; CISA KEV lists a required remediation due date of 2026-08-25 under BOD 26-04
- Block the identified C2/distribution domains (envell.xyz, enveil.online, uxtramine.org) and IPs (135.181.67.203, 135.181.185.158) at the perimeter and DNS layer
- Hunt for and remove the identified DLL loader, MISTPEN, ForestTiger, FudModule, Troy, and RelayShell file hashes across Windows endpoints and internet-facing web servers
- Patch Roundcube Webmail to 1.5.10+ or 1.6.11+ to close CVE-2025-49113 and audit for unauthorized PHP webshells on any exposed webmail, WordPress, or SharePoint hosts
Workarounds
- Where immediate patching is not possible, apply CISA BOD 26-04 mitigation and forensic-triage guidance and restrict local logon on exposed Windows 11 24H2/25H2 hosts
- Block execution of unsigned or unexpected PDF-viewer installers obtained from non-standard/non-vendor download sources
Longer-term hardening
- Deploy EDR/XDR with kernel-level, ETW-tamper-resistant telemetry capable of detecting FudModule-class rootkit behavior (ETW provider suppression, crash-dump suppression, Smart App Control tampering)
- Train defense, aerospace, and aviation personnel to verify recruiter identities out-of-band before downloading any "security" software promoted via LinkedIn/messaging-platform job offers
- Monitor for SEO-poisoned lookalike domains impersonating employer or vendor brand names used in recruitment lures
- Restrict, log, and alert on outbound Microsoft Graph API/OneDrive traffic from endpoints not associated with sanctioned productivity workflows, given its use as a dead-drop C2 channel
CVEs associated with Lazarus Exploits CVE-2026-68820 Zero-Day via Malicious PDF
Weaknesses (CWE) in Lazarus Exploits CVE-2026-68820 Zero-Day via Malicious PDF
CWE-416, CWE-502
Timeline of Lazarus Exploits CVE-2026-68820 Zero-Day via Malicious PDF
- Check Point Research begins tracking a new wave of Operation Dream Job primarily targeting defense, aerospace, and aviation organizations worldwide (reported as "since early 2026").
- Check Point Research confirms successful in-the-wild implementation of the CVE-2026-68820 afd.sys exploit by Lazarus.
- Independent reporting places sustained active exploitation of the afd.sys zero-day from early July 2026, continuing until the August patch -- Lazarus ran the exploit for at least five weeks before a fix was available.
- Check Point Research reports the afd.sys use-after-free vulnerability to the Microsoft Security Response Center (MSRC).
- Microsoft confirms the reported vulnerability.
- CVE-2026-68820 is officially assigned to the Windows afd.sys use-after-free privilege-escalation vulnerability.
- Microsoft releases a fix for CVE-2026-68820 in the August 2026 Patch Tuesday update; CISA adds the CVE to the Known Exploited Vulnerabilities catalog the same day with a remediation due date of 2026-08-25.
- Check Point Research, The Hacker News, and Help Net Security publicly disclose the Operation Dream Job zero-day campaign, detailing the SecurityPDF trojanized viewer, Troy backdoor, MISTPEN downloader, and FudModule v3.1 rootkit.
- AhnLab ASEC's August 2026 APT group trend report references Lazarus's use of a malicious PDF viewer and a zero-day (CVE-2026-68820) exploited before public disclosure in Operation Dream Job attacks against the defense industry.
Sources cited for Lazarus Exploits CVE-2026-68820 Zero-Day via Malicious PDF
- 2026년 8월 APT 그룹 동향 보고서 (August 2026 APT Group Trend Report)
- Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack
- Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
- Lazarus hackers pair fake job offers with Windows zero-day exploit
- CVE-2026-68820 Detail
- CISA Known Exploited Vulnerabilities Catalog - CVE-2026-68820
- Microsoft Security Update Guide - CVE-2026-68820
- Over 84,000 Roundcube instances vulnerable to actively exploited flaw
More in zero day
- European Parliament Member Investigating Pegasus Spyware Hacked With Pegasus (PWNYOURHOME Zero-Click Exploit Chain)
- Google Chrome V8 Zero-Day CVE-2026-11645 Out-of-Bounds Read/Write Exploited in the Wild
- KnowledgeDeliver LMS ViewState Deserialization Zero-Day CVE-2026-5426 — Unauthenticated RCE via Shared ASP.NET machineKey + BLUEBEAM (Godzilla) Web Shell and Cobalt Strike BEACON Watering Hole
- LiteSpeed User-End cPanel Plugin 0-Day CVE-2026-48172 — lsws.redisAble Local Privilege Escalation Exploited in the Wild
- Windows 'MiniPlasma' Zero-Day — Unpatched SYSTEM LPE via cldflt.sys HsmOsBlockPlaceholderAccess / CfAbortHydration (CVE-2020-17103 Regression)
Detection coverage for TL-2026-2561
As of 2026-09-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2561 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.