# NSFOCUS Monthly APT Insights August 2026: Lazarus MISTPEN/ForestTiger/RelayShell Campaign with CVE-2026-68820, UAC-0099 LUNCHPOKE/BURNYBEAR/MATCHBOIL.V2, CVE-2026-42897 Exchange OWA Exploitation

> NSFOCUS FUYING Lab recorded 20 APT activities in August 2026, 70% delivered by spear-phishing and 50% aimed at government agencies, with Kimsuky, Lazarus, DarkHotel, UAC-0099 and Transparent Tribe among the attributed groups. Key events: Lazarus (Operation Dream Job) hit defense and aerospace targets in Europe and India using MISTPEN, ForestTiger, FudModule, RelayShell and a Windows AFD.sys zero-day (CVE-2026-68820); UAC-0099 targeted Ukrainian government and critical infrastructure with LUNCHPOKE, BURNYBEAR and MATCHBOIL.V2; and Eastern European actors exploited the Exchange OWA cross-site scripting flaw CVE-2026-42897.

- **Published:** 2026-10-21T13:35:23Z
- **Last reviewed:** 2026-10-21T13:35:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4041
- **ID:** TL-2026-4041
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Lazarus Group (North Korea, Russia)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-42897, CVE-2026-68820, CVE-2025-49113

## Description

NSFOCUS published its Monthly APT Insights for August 2026 on 2026-10-21. FUYING Lab detected 20 APT attack activities concentrated in East Asia, Eastern Europe, the Middle East and South Asia. Spear-phishing accounted for 70% of events, followed by vulnerability exploitation, supply-chain and watering-hole attacks. Government agencies were the most targeted category (50%), followed by organizations and individuals (25%), military institutions and financial services. Kimsuky, Lazarus and DarkHotel were the most active East Asian groups. In East Asia, Korean government, military and individual targets received spear-phishing that combined a Korean-language lure ('Guidelines for Managing Changes to Store Master Data') with software vulnerability exploitation. In South Asia, Transparent Tribe targeted Afghan and Indian government agencies with a counterfeit version of Afghan Telecom's (AFTEL) TMS telecommunications management tool.

Lazarus / Operation Dream Job (reported by Check Point Research, 2026-08-11). The campaign targeted the defense sector, especially aerospace and aviation, with confirmed compromises in France, Germany, India and Brazil. Lures were fake recruiter approaches, including LinkedIn messages. Lazarus also sent phishing from already-compromised French organizations to get past reputation filters. Chain 1: an encrypted ZIP ('Senior_Project_Manager.zip') holds a legitimately signed PDF viewer, a malicious libmupdf.dll and an encrypted payload. The viewer side-loads the DLL, which runs the in-memory downloader MISTPEN and shows a 'Job Description' decoy. MISTPEN talks to OneDrive through the Microsoft Graph API with AES-encrypted traffic. It loads modules for host reconnaissance, persistence, screen capture (OneScreenCapture64.dll) and local privilege escalation, then the ForestTiger (ScoringMathTea) backdoor. Chain 2: phishing that impersonates Enveil steers victims to fake sites that rank high in search results. These sites serve 'SecurityPDF', a trojanized MuPDF viewer, plus a crafted PDF; the viewer loads the Troy in-memory backdoor (17 operator commands) through reflective DLL injection. Both chains use CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver for WinSock (AFD.sys, CVSS 7.0, CWE-416), to gain kernel privileges. Exploitation was seen from June 2026; Check Point reported the flaw in late July and Microsoft patched it on 2026-08-11, the same day CISA added it to KEV. With kernel access the actor deploys the FudModule 3.1 rootkit, which hides tooling and can disable Windows Smart App Control. ForestTiger's C2 runs on compromised WordPress and SharePoint sites and on Roundcube webmail servers compromised through CVE-2025-49113. On that infrastructure the PHP web shell RelayShell passes commands as text files, and operators reached it via ExpressVPN.

UAC-0099 (reported by CERT-UA, July 2026). The Russia-aligned group, active since at least mid-2022 and assessed as an initial-access provider for follow-on operations, targeted Ukrainian government and critical infrastructure. Phishing emails used a shortened URL to send victims to the EasySend file-sharing service, which served a ZIP holding a script with a double extension (e.g. 2060.docx.wsf, or VBS disguised as PDF), run by wscript.exe. The script unpacks a legitimate Notepad++ 8.8.3 into a randomly named directory, and Notepad++ loads the malicious plugin NppExport.dll (LUNCHPOKE). LUNCHPOKE uses a bundled legitimate WinRAR to extract the password-protected updater.rar, which contains RemoteLibUpdater.exe (BURNYBEAR loader) and InitTest.dll (MATCHBOIL.V2, a C# loader/backdoor). MATCHBOIL.V2 handles persistence, C2, payload deployment and data exfiltration. A scheduled task runs RemoteLibUpdater.exe every three minutes. Launched without the expected arguments, the loader exhausts CPU and RAM as an anti-analysis measure.

CVE-2026-42897 Exchange OWA exploitation. Microsoft disclosed this cross-site scripting flaw on 2026-05-14 (CVSS 8.1, CWE-79). When a crafted email is opened in Outlook Web Access, Exchange mishandles the embedded HTML and the attacker's JavaScript runs in the victim's OWA session. CISA added it to KEV on 2026-05-15, and Microsoft shipped a definitive fix in June 2026. NSFOCUS saw Eastern European APT actors use it against Ukrainian, Romanian and Spanish government bodies. Proofpoint separately attributed exploitation to the Russia-affiliated TA488 (Laundry Bear / Void Blizzard), whose infrastructure dates to March 2026, against US and European government and private-sector targets. The resulting OWAReaper implant persists through encrypted copies in browser storage and hidden iframes in cached messages. It abuses Outlook add-ins with ReadWriteMailbox permission to steal OAuth tokens and grants the Default user Owner rights on every mail folder. It steals addresses, usernames, Outlook settings and credentials, exfiltrates over HTTPS or DNS, and takes tasking from public GitHub commit messages or inbound attacker emails.

Defensive priorities: patch CVE-2026-68820 and CVE-2026-42897, hunt for signed binaries loading libmupdf.dll or NppExport.dll from user-writable paths, audit mailbox folder permissions and OAuth grants, and watch for Graph API/OneDrive traffic from unexpected processes.

## MITRE ATT&CK

- T1584.004 Compromise Infrastructure: Server
- T1608.006 Stage Capabilities: SEO Poisoning
- T1566.001 Phishing: Spearphishing Attachment
- T1566.003 Phishing: Spearphishing via Service
- T1204.002 User Execution: Malicious File
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1203 Exploitation for Client Execution
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1505.003 Server Software Component: Web Shell
- T1098.002 Account Manipulation: Additional Email Delegate Permissions
- T1574.001 Hijack Execution Flow: DLL
- T1036.007 Masquerading: Double File Extension
- T1014 Rootkit
- T1685 Disable or Modify Tools
- T1620 Reflective Code Loading
- T1528 Steal Application Access Token
- T1082 System Information Discovery
- T1113 Screen Capture
- T1114.002 Email Collection: Remote Email Collection

## Sources

- [NSFOCUS Monthly APT Insights - August 2026](https://nsfocusglobal.com/nsfocus-monthly-apt-insights-august-2026/)
- [Check Point Research - Shattering the Dream: When a Job Offer Becomes a Zero-Day Attack](https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/)
- [The Hacker News - Lazarus Exploits Windows Zero-Day](https://thehackernews.com/2026/08/lazarus-exploits-windows-zero-day-to.html)
- [CERT-UA - UAC-0099: LUNCHPOKE, BURNYBEAR, MATCHBOIL.V2 and use of Notepad++ 8.8.3](https://cert.gov.ua/article/6318634)
- [The Hacker News - Fake Notepad++ Plugin Delivers UAC-0099 Malware](https://thehackernews.com/2026/07/fake-notepad-plugin-delivers.html)
- [BleepingComputer - Hackers abuse Notepad++ plugins to stealthily install malware](https://www.bleepingcomputer.com/news/security/hackers-abuse-notepad-plus-plus-plugins-to-stealthily-install-malware/)
- [Help Net Security - CVE-2026-42897 Microsoft Exchange email attack (Proofpoint, TA488 OWAReaper)](https://helpnetsecurity.com/2026/07/30/cve-2026-42897-microsoft-exchange-email-attack)
- [MSRC - CVE-2026-42897 Microsoft Exchange Server Spoofing (XSS) Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897)
- [MSRC - CVE-2026-68820 Windows Ancillary Function Driver for WinSock Elevation of Privilege](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820)
- [NVD - CVE-2026-42897](https://nvd.nist.gov/vuln/detail/CVE-2026-42897)
- [NVD - CVE-2026-68820](https://nvd.nist.gov/vuln/detail/CVE-2026-68820)
- [CISA KEV - CVE-2026-42897](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897)
- [CISA KEV - CVE-2026-68820](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-68820)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4041