# Lazarus Exploits CVE-2026-68820 Zero-Day via Malicious PDF Viewer in Operation Dream Job Against Defense Industry

> Lazarus Group ran a wave of Operation Dream Job against defense, aerospace, and aviation organizations in Europe, India, and Brazil, using fake job offers impersonating Lockheed Martin and Enveil to deliver a trojanized "SecurityPDF" viewer and a DLL-sideloading chain that exploited an afd.sys use-after-free zero-day (CVE-2026-68820) to gain SYSTEM access via the FudModule v3.1 rootkit. AhnLab ASEC's August 2026 APT trend report independently confirms Lazarus's use of a malicious PDF viewer plus a pre-disclosure zero-day against the defense industry.

- **Published:** 2026-09-18T00:00:00Z
- **Last reviewed:** 2026-09-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2561
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-lazarus-operation-dream-job-tl-2026-2561.webp?v=286bb439 (Threadlinqs threat intel: CVE-2026-68820 afd.sys PDF Viewer Exploit: Detection & IOCs (TL-2026-2561) — Critical severity, 29 IOCs, 9 detection rules.)
- **ID:** TL-2026-2561
- **Severity:** CRITICAL (CVSS 7)
- **Category:** ZERO_DAY
- **Status:** ACTIVE
- **Actor:** Lazarus Group (North Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (3 shown free below)
- **CVEs:** CVE-2026-68820, CVE-2025-49113

## Description

Since early 2026, Check Point Research tracked a wave of the DPRK-linked Lazarus Group's long-running Operation Dream Job campaign focused on defense, aerospace, and aviation organizations across Western Europe (France, Germany), India, and, secondarily, Brazil. The operation used fraudulent recruiter outreach on LinkedIn and messaging platforms impersonating Lockheed Martin and the privacy-enhancing-technology firm Enveil, directing targets to lookalike websites (envell.xyz, enveil.online, uxtramine.org) that were promoted via search-engine-optimization (SEO) poisoning to rank highly for terms like "Enveil SecurityPDF."

Two parallel infection chains were used. The first delivered an encrypted ZIP containing a legitimate PDF viewer alongside a malicious DLL (libmupdf.dll) that side-loads, displays a decoy job-description PDF, and launches the in-memory MISTPEN downloader, which retrieves further modules via the Microsoft Graph API/OneDrive as a covert C2 channel and can deploy the ForestTiger (aka ScoringMathTea) backdoor. The second chain distributed a trojanized "SecurityPDF" viewer (built on the MuPDF framework) that watches File->Open and drag-and-drop actions for a marker string embedded in crafted PDFs ("This document is encrypted with sumatrapdf reader!!!!!!!!!!!!!!"), then extracts an embedded payload with a single-byte XOR key (0x39), writes it to %TEMP%\new.exe, and reflectively loads the Troy backdoor -- a 64-bit modular RAT with 17 operator commands covering file operations, an interactive shell, process enumeration, and in-memory DLL injection.

Both chains converge on privilege escalation via CVE-2026-68820, a use-after-free (CWE-416) in the Windows Ancillary Function Driver for WinSock (afd.sys), triggered by a race condition when a socket is accessed concurrently by multiple threads without synchronization, corrupting freed memory to obtain kernel read/write primitives on Windows 11 builds 26100 (24H2) and 26200 (25H2). Check Point observed successful in-the-wild exploitation as early as June 2026, reported the flaw to Microsoft on July 28, 2026; Microsoft confirmed it July 31, assigned CVE-2026-68820 on August 5, and shipped a fix on August 11 -- meaning Lazarus ran the exploit for at least five weeks pre-patch. The exploit deploys FudModule v3.1, a kernel-mode rootkit that retains v3's ETW provider killlist (94 GUIDs), crash-dump suppression, WFP staging, and privileged-handle forgery, and adds tampering with Windows Smart App Control (zeroing VerifiedAndReputablePolicyState via NtSetSystemInformation class 0xA4) and code-integrity policy reload inside a SYSTEM-context msiexec.exe.

C2 and exfiltration infrastructure relied on compromised, legitimately-owned web servers rather than actor-owned hosts: a previously undocumented PHP webshell, RelayShell, was deployed on hijacked Roundcube webmail instances (many vulnerable to CVE-2025-49113, an unauthenticated-adjacent PHP object-deserialization RCE), as well as compromised WordPress and SharePoint sites, acting as dual-mode (victim/operator) relay nodes using file-based message-passing. Seventeen unique RelayShell identifiers were observed; operators connected via commercial VPN (ExpressVPN) services. Troy's own C2 protocol validates a "CONNECTED" handshake string and exchanges base64-encoded, JSON-wrapped commands, while MISTPEN's LPE loader module generates ML-KEM (Kyber) post-quantum asymmetric key material to secure its channel. At least one compromised French defense-sector organization was repurposed as launch infrastructure for further spear-phishing.

Check Point attributes the campaign to Lazarus with high confidence based on TTP overlap, malware family reuse, and PDB paths referencing "Troy." AhnLab ASEC's separately published August 2026 APT group trend report corroborates the core finding -- Lazarus combining a malicious PDF viewer with a zero-day exploited before public disclosure in Operation Dream Job attacks against the defense industry -- without providing additional IOCs beyond what Check Point, The Hacker News, and Help Net Security had already documented.

## MITRE ATT&CK

- T1583.001 Domains
- T1608.006 SEO Poisoning
- T1584.004 Server
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1574.001 DLL
- T1053.005 Scheduled Task
- T1620 Reflective Code Loading
- T1014 Rootkit
- T1685 Disable or Modify Tools
- T1685 Disable or Modify Tools
- T1082 System Information Discovery
- T1057 Process Discovery
- T1113 Screen Capture
- T1573.002 Asymmetric Cryptography
- T1071.001 Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Operation Dream Job — Trojanized SecurityPDF Viewer / libmupdf.dll DLL Side-Load Delivery** (`TL-2026-2561-SPL-001`)

Detects the initial delivery stage of Lazarus's Operation Dream Job defense-industry campaign: execution of the trojanized 'SecurityPDF' viewer or side-loading of libmupdf.dll from a non-standard path, or file drops matching known dropper/installer SHA256 hashes distributed via fake Lockheed Martin/Enveil recruiter lures on envell.xyz, enveil.online, and uxtramine.org.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.002, T1204.002, T1574.002
- **Data sources:** sysmon, windows_security, edr_image_load
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=7 OR EventCode=11)
| where (EventCode=7 AND ImageLoaded="*\\libmupdf.dll" AND NOT ImageLoaded="*\\Program Files\\*")
   OR (EventCode=1 AND (Image="*\\SecurityPDF.exe" OR CommandLine="*SecurityPDF*"))
   OR (EventCode=11 AND Hashes IN ("SHA256=2b4987c07a3d9a9a5d1a9bf4efa3d1903e775090b611710edafdc92874265ca8","SHA256=3a02d0d798e8d35555776886d92b20ff38a101c9ef7e0eebc8ce5d259516525a","SHA256=743172aab606974b054a64561534ae66baa3a840657f79d7c6fa18350e8d45d1","SHA256=db3d69b7eeda2e35e23006bf4b7e206281fce809584207214fc213f9bc30376d"))
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as image values(CommandLine) as cmdline values(ImageLoaded) as loaded_dll values(TargetFilename) as dropped_file by ComputerName, User, EventCode
| where count > 0
```

### Microsoft KQL

```kql
DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FileName =~ "libmupdf.dll" and FolderPath !contains @"\Program Files"
| project Timestamp, DeviceName, InitiatingProcessAccountName=AccountName, InitiatingProcessFileName, FileName, FolderPath, SHA256
| union (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where SHA256 in ("2b4987c07a3d9a9a5d1a9bf4efa3d1903e775090b611710edafdc92874265ca8","3a02d0d798e8d35555776886d92b20ff38a101c9ef7e0eebc8ce5d259516525a","743172aab606974b054a64561534ae66baa3a840657f79d7c6fa18350e8d45d1","db3d69b7eeda2e35e23006bf4b7e206281fce809584207214fc213f9bc30376d")
    | project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FileName, FolderPath, SHA256
)
| sort by Timestamp desc
```

### Sigma

```yaml
title: Lazarus libmupdf.dll DLL Side-Load — SecurityPDF/MISTPEN Delivery
id: 1a2b3c4d-5e6f-4789-9abc-def012345001
status: experimental
description: Detects libmupdf.dll being side-loaded from a non-standard path by a SecurityPDF-branded process, the delivery mechanism for the Lazarus Operation Dream Job MISTPEN downloader chain.
references:
    - https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/
author: Threadlinqs Team
date: 2026/09/18
tags:
    - attack.initial-access
    - attack.t1566.002
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1574.002
    - attack.group.lazarus
    - attack.tool.mistpen
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\libmupdf.dll'
    filter_legit:
        ImageLoaded|contains: '\Program Files\'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate MuPDF-based PDF viewers installed under Program Files; this rule excludes that path
level: high
```

**Known false positives:**

- Legitimate MuPDF-based PDF viewer installations under Program Files that happen to ship libmupdf.dll — excluded by the path filter, but verify vendor signing on any hit outside it

**Tuning notes:** Add an allowlist of signed, vendor-approved PDF viewer install paths per fleet; tighten the hash list as Check Point/AhnLab publish additional SecurityPDF installer variants.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- MISTPEN Downloader Dead-Drop C2 via Microsoft Graph API/OneDrive (locked: unlock with TL Creds)
- FudModule v3.1 Smart App Control Policy Zeroing (VerifiedAndReputablePolicyState) (locked: unlock with TL Creds)
- Outbound Connection to Operation Dream Job C2 or OSINT-Corroborated DPRK Sibling Infrastructure (locked: unlock with TL Creds)
- SecurityPDF Trojanized Viewer XOR Payload Extraction Dropping Troy via new.exe (locked: unlock with TL Creds)
- FudModule v3.1 SYSTEM msiexec.exe Anomalous Child Process Spawn (locked: unlock with TL Creds)
- Troy Backdoor Post-Exploitation Discovery and Shell Command Execution (locked: unlock with TL Creds)
- afd.sys CVE-2026-68820 Exploitation / FudModule v3.1 SYSTEM-Context msiexec.exe Chain (locked: unlock with TL Creds)
- Troy Backdoor C2 Handshake / MISTPEN Dead-Drop / RelayShell Relay Traffic (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 29)

Defanged, TLP:CLEAR.

- IP address: `135.181.67[.]203`
- Domain: `envell[.]xyz`
- File hash: `2b4987c07a3d9a9a5d1a9bf4efa3d1903e775090b611710edafdc92874265ca8`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [2026년 8월 APT 그룹 동향 보고서 (August 2026 APT Group Trend Report)](https://asec.ahnlab.com/ko/95477/)
- [Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack](https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/)
- [Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor](https://thehackernews.com/2026/08/lazarus-exploits-windows-zero-day-to.html)
- [Lazarus hackers pair fake job offers with Windows zero-day exploit](https://www.helpnetsecurity.com/2026/08/12/north-korea-lazarus-fake-job-offers/)
- [CVE-2026-68820 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-68820)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-68820](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Microsoft Security Update Guide - CVE-2026-68820](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-68820)
- [Over 84,000 Roundcube instances vulnerable to actively exploited flaw](https://www.bleepingcomputer.com/news/security/over-84-000-roundcube-instances-vulnerable-to-actively-exploited-flaw/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2561