Threat reportAPTTL-2026-4041
NSFOCUS Monthly APT Insights August 2026: Lazarus MISTPEN/ForestTiger/RelayShell Campaign with CVE-2026-68820, UAC-0099 LUNCHPOKE/BURNYBEAR/MATCHBOIL.V2, CVE-2026-42897 Exchange OWA Exploitation
NSFOCUS Monthly APT Insights August 2026 (TL-2026-4041), also tracked as Operation Dream Job, is a high-severity advanced persistent threat campaign, first published 2026-10-21. It is attributed to Lazarus Group (North Korea, Russia) with medium confidence, affects Microsoft Windows (Ancillary Function Driver for WinSock, AFD.sys), references 3 CVEs (CVE-2026-42897, CVE-2026-68820, CVE-2025-49113), maps to 20 MITRE ATT&CK techniques (T1014, T1036.007, T1053.005), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 20MITRE ATT&CK
- Actors
- 4Lazarus Group
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-4041
- Threat ID
- TL-2026-4041
- Also known as
- Operation Dream Job, NSFOCUS APT Insights August 2026, OWAReaper
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- Lazarus Group, UAC-0099, TA488, Kimsuky
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea, Russia
- Motivation
- ESPIONAGE
- Target sectors
- government administration, military, defense, aerospace, aviation, critical-infrastructure, telecoms, finance
- Target regions
- ukraine, south korea, france, germany, india, brazil, afghanistan, romania, spain, united states of america, Europe
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in NSFOCUS Monthly APT Insights August 2026
Malware and tooling: ForestTiger, FudModule, MATCHBOIL.V2, MISTPEN, OWAReaper
How NSFOCUS Monthly APT Insights August 2026 works
NSFOCUS FUYING Lab recorded 20 APT activities in August 2026, 70% delivered by spear-phishing and 50% aimed at government agencies, with Kimsuky, Lazarus, DarkHotel, UAC-0099 and Transparent Tribe among the attributed groups. Key events: Lazarus (Operation Dream Job) hit defense and aerospace targets in Europe and India using MISTPEN, ForestTiger, FudModule, RelayShell and a Windows AFD.sys zero-day (CVE-2026-68820); UAC-0099 targeted Ukrainian government and critical infrastructure with LUNCHPOKE, BURNYBEAR and MATCHBOIL.V2; and Eastern European actors exploited the Exchange OWA cross-site scripting flaw CVE-2026-42897.
NSFOCUS published its Monthly APT Insights for August 2026 on 2026-10-21. FUYING Lab detected 20 APT attack activities concentrated in East Asia, Eastern Europe, the Middle East and South Asia. Spear-phishing accounted for 70% of events, followed by vulnerability exploitation, supply-chain and watering-hole attacks. Government agencies were the most targeted category (50%), followed by organizations and individuals (25%), military institutions and financial services. Kimsuky, Lazarus and DarkHotel were the most active East Asian groups. In East Asia, Korean government, military and individual targets received spear-phishing that combined a Korean-language lure ('Guidelines for Managing Changes to Store Master Data') with software vulnerability exploitation. In South Asia, Transparent Tribe targeted Afghan and Indian government agencies with a counterfeit version of Afghan Telecom's (AFTEL) TMS telecommunications management tool.
Lazarus / Operation Dream Job (reported by Check Point Research, 2026-08-11). The campaign targeted the defense sector, especially aerospace and aviation, with confirmed compromises in France, Germany, India and Brazil. Lures were fake recruiter approaches, including LinkedIn messages. Lazarus also sent phishing from already-compromised French organizations to get past reputation filters. Chain 1: an encrypted ZIP ('Senior_Project_Manager.zip') holds a legitimately signed PDF viewer, a malicious libmupdf.dll and an encrypted payload. The viewer side-loads the DLL, which runs the in-memory downloader MISTPEN and shows a 'Job Description' decoy. MISTPEN talks to OneDrive through the Microsoft Graph API with AES-encrypted traffic. It loads modules for host reconnaissance, persistence, screen capture (OneScreenCapture64.dll) and local privilege escalation, then the ForestTiger (ScoringMathTea) backdoor. Chain 2: phishing that impersonates Enveil steers victims to fake sites that rank high in search results. These sites serve 'SecurityPDF', a trojanized MuPDF viewer, plus a crafted PDF; the viewer loads the Troy in-memory backdoor (17 operator commands) through reflective DLL injection. Both chains use CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver for WinSock (AFD.sys, CVSS 7.0, CWE-416), to gain kernel privileges. Exploitation was seen from June 2026; Check Point reported the flaw in late July and Microsoft patched it on 2026-08-11, the same day CISA added it to KEV. With kernel access the actor deploys the FudModule 3.1 rootkit, which hides tooling and can disable Windows Smart App Control. ForestTiger's C2 runs on compromised WordPress and SharePoint sites and on Roundcube webmail servers compromised through CVE-2025-49113. On that infrastructure the PHP web shell RelayShell passes commands as text files, and operators reached it via ExpressVPN.
UAC-0099 (reported by CERT-UA, July 2026). The Russia-aligned group, active since at least mid-2022 and assessed as an initial-access provider for follow-on operations, targeted Ukrainian government and critical infrastructure. Phishing emails used a shortened URL to send victims to the EasySend file-sharing service, which served a ZIP holding a script with a double extension (e.g. 2060.docx.wsf, or VBS disguised as PDF), run by wscript.exe. The script unpacks a legitimate Notepad++ 8.8.3 into a randomly named directory, and Notepad++ loads the malicious plugin NppExport.dll (LUNCHPOKE). LUNCHPOKE uses a bundled legitimate WinRAR to extract the password-protected updater.rar, which contains RemoteLibUpdater.exe (BURNYBEAR loader) and InitTest.dll (MATCHBOIL.V2, a C# loader/backdoor). MATCHBOIL.V2 handles persistence, C2, payload deployment and data exfiltration. A scheduled task runs RemoteLibUpdater.exe every three minutes. Launched without the expected arguments, the loader exhausts CPU and RAM as an anti-analysis measure.
CVE-2026-42897 Exchange OWA exploitation. Microsoft disclosed this cross-site scripting flaw on 2026-05-14 (CVSS 8.1, CWE-79). When a crafted email is opened in Outlook Web Access, Exchange mishandles the embedded HTML and the attacker's JavaScript runs in the victim's OWA session. CISA added it to KEV on 2026-05-15, and Microsoft shipped a definitive fix in June 2026. NSFOCUS saw Eastern European APT actors use it against Ukrainian, Romanian and Spanish government bodies. Proofpoint separately attributed exploitation to the Russia-affiliated TA488 (Laundry Bear / Void Blizzard), whose infrastructure dates to March 2026, against US and European government and private-sector targets. The resulting OWAReaper implant persists through encrypted copies in browser storage and hidden iframes in cached messages. It abuses Outlook add-ins with ReadWriteMailbox permission to steal OAuth tokens and grants the Default user Owner rights on every mail folder. It steals addresses, usernames, Outlook settings and credentials, exfiltrates over HTTPS or DNS, and takes tasking from public GitHub commit messages or inbound attacker emails.
Defensive priorities: patch CVE-2026-68820 and CVE-2026-42897, hunt for signed binaries loading libmupdf.dll or NppExport.dll from user-writable paths, audit mailbox folder permissions and OAuth grants, and watch for Graph API/OneDrive traffic from unexpected processes.
MITRE ATT&CK techniques used in TL-2026-4041
Defense Evasion
T1014 Rootkit; T1036.007 Masquerading: Double File Extension; T1574.001 Hijack Execution Flow: DLL; T1620 Reflective Code Loading
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task; T1098.002 Account Manipulation: Additional Email Delegate Permissions; T1505.003 Server Software Component: Web Shell
Execution
T1059.005 Command and Scripting Interpreter: Visual Basic; T1059.007 Command and Scripting Interpreter: JavaScript; T1203 Exploitation for Client Execution; T1204.002 User Execution: Malicious File
Discovery
T1082 System Information Discovery
Collection
T1113 Screen Capture; T1114.002 Email Collection: Remote Email Collection
Credential Access
T1528 Steal Application Access Token
Initial Access
T1566.001 Phishing: Spearphishing Attachment; T1566.003 Phishing: Spearphishing via Service
Resource Development
T1584.004 Compromise Infrastructure: Server; T1608.006 Stage Capabilities: SEO Poisoning
defense-impairment
Affected products and versions in NSFOCUS Monthly APT Insights August 2026
- Microsoft — Windows (Ancillary Function Driver for WinSock, AFD.sys)
Vulnerable versions: Windows 10 1607; Windows 10 1809; Windows 10 21H2; Windows 10 22H2; Windows 11 23H2; Windows 11 24H2; Windows 11 25H2; Windows 11 26H1; Windows Server 2012 through 2025
Fixed in: August 2026 cumulative updates (2026-08-11) - Microsoft — Exchange Server (Outlook Web Access)
Vulnerable versions: Exchange Server builds prior to the CVE-2026-42897 security update
Fixed in: Exchange Server security update for CVE-2026-42897 (June 2026) - Roundcube — Roundcube Webmail
Vulnerable versions: Versions affected by CVE-2025-49113 (abused as Lazarus C2 infrastructure)
Fixed in: Vendor-patched releases for CVE-2025-49113 - Notepad++ — Notepad++ (abused legitimate binary for side-loading)
Vulnerable versions: 8.8.3 (bundled by UAC-0099)
Fixed in: Latest release (CERT-UA recommends updating)
Remediation for NSFOCUS Monthly APT Insights August 2026
Patches
- Microsoft August 2026 Patch Tuesday: CVE-2026-68820 (Windows 10, Windows 11, Windows Server 2012-2025)
- Microsoft Exchange Server security update for CVE-2026-42897 (definitive fix June 2026)
- Roundcube Webmail fix for CVE-2025-49113
- Update WinRAR, 7-Zip and Notepad++ to the latest versions (CERT-UA guidance)
Immediate actions
- Apply the August 2026 Windows security updates for CVE-2026-68820 (AFD.sys use-after-free), listed in CISA KEV with a 2026-08-25 due date
- Apply the Exchange Server security update for CVE-2026-42897, and keep the Exchange Emergency Mitigation Service enabled on unpatched servers
- Block the domains envell.xyz, enveil.online and uxtramine.org and the IPs 135.181.67.203 and 135.181.185.158 at the perimeter
- Sweep endpoints for the Check Point hashes of MISTPEN, ForestTiger, FudModule, Troy and RelayShell
- Audit Exchange mailbox folder permissions for Default-user Owner grants, and audit Outlook add-ins and OAuth consents with ReadWriteMailbox scope
Workarounds
- Restrict OWA access to VPN or trusted networks until Exchange is patched
- Disable or restrict Outlook add-ins that request ReadWriteMailbox permission
- Use an AppLocker/WDAC policy to block script hosts (wscript.exe, cscript.exe) for standard users
- Block link-shortener and anonymous file-sharing services (e.g. EasySend) where business allows
Longer-term hardening
- Alert on signed executables loading libmupdf.dll, NppExport.dll or other unexpected DLLs from user-writable directories
- Enable the Microsoft vulnerable driver blocklist and HVCI to limit kernel rootkits such as FudModule
- Watch for Microsoft Graph API and OneDrive access from non-Microsoft processes
- Harden Roundcube, WordPress and SharePoint servers to deny attackers C2 relay infrastructure (patch CVE-2025-49113)
- Train staff in defense and aerospace on fake recruiter and job-offer lures, including LinkedIn approaches
- Block or alert on wscript.exe running double-extension .wsf or .vbs files from archives
CVEs associated with NSFOCUS Monthly APT Insights August 2026
Weaknesses (CWE) in NSFOCUS Monthly APT Insights August 2026
Timeline of NSFOCUS Monthly APT Insights August 2026
- Proofpoint reports TA488 (Laundry Bear) created infrastructure for its OWA exploitation campaign in March 2026
- Microsoft discloses CVE-2026-42897, an Exchange Server OWA cross-site scripting flaw (CVSS 8.1), and warns of exploitation
- CISA adds CVE-2026-42897 to KEV with a 2026-05-29 remediation due date
- Check Point observes Lazarus exploiting the AFD.sys zero-day CVE-2026-68820 in Operation Dream Job intrusions from June 2026; Microsoft ships the definitive Exchange fix for CVE-2026-42897 the same month
- CERT-UA publishes its UAC-0099 alert on LUNCHPOKE, BURNYBEAR, MATCHBOIL.V2 and the abuse of Notepad++ 8.8.3 against Ukrainian targets
- Check Point Research reports CVE-2026-68820 to Microsoft
- Proofpoint research on TA488 exploiting CVE-2026-42897 with the OWAReaper implant against US and European government targets is published
- Microsoft patches CVE-2026-68820 on Patch Tuesday, CISA adds it to KEV, and Check Point publishes its Operation Dream Job analysis with IOCs
- CISA KEV remediation deadline for CVE-2026-68820
- End of the NSFOCUS reporting month: 20 APT activities recorded, 70% spear-phishing, 50% targeting government
- NSFOCUS publishes Monthly APT Insights for August 2026, covering Lazarus, UAC-0099, Transparent Tribe and CVE-2026-42897 exploitation
Sources cited for NSFOCUS Monthly APT Insights August 2026
- NSFOCUS Monthly APT Insights - August 2026
- Check Point Research - Shattering the Dream: When a Job Offer Becomes a Zero-Day Attack
- The Hacker News - Lazarus Exploits Windows Zero-Day
- CERT-UA - UAC-0099: LUNCHPOKE, BURNYBEAR, MATCHBOIL.V2 and use of Notepad++ 8.8.3
- The Hacker News - Fake Notepad++ Plugin Delivers UAC-0099 Malware
- BleepingComputer - Hackers abuse Notepad++ plugins to stealthily install malware
- Help Net Security - CVE-2026-42897 Microsoft Exchange email attack (Proofpoint, TA488 OWAReaper)
- MSRC - CVE-2026-42897 Microsoft Exchange Server Spoofing (XSS) Vulnerability
- MSRC - CVE-2026-68820 Windows Ancillary Function Driver for WinSock Elevation of Privilege
- NVD - CVE-2026-42897
- NVD - CVE-2026-68820
- CISA KEV - CVE-2026-42897
- CISA KEV - CVE-2026-68820
Detection coverage for TL-2026-4041
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4041 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.