Lazarus Group Weaponizes Windows Zero-Day in Global Defense Sector Campaign

Key points

• Lazarus Group exploited CVE-2026-68820, a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys), to gain SYSTEM privileges.
• The attack is part of 'Operation Dream Job,' which uses fraudulent recruitment offers to target defense and aerospace professionals.
• Microsoft patched the vulnerability on August 11, 2026, during Patch Tuesday, marking it as actively exploited.
• Attackers deployed a new backdoor called Troy and an updated FudModule rootkit (version 3.1) that can tamper with Smart App Control.
• The campaign targeted organizations in France, Germany, India, and Brazil, with at least one compromised French entity used for spear-phishing.
• Attackers also compromised Roundcube webmail servers using CVE-2025-49113 and a new PHP web shell called RelayShell for command-and-control.

Background

This incident follows Microsoft’s August 2026 Patch Tuesday, which addressed 398 vulnerabilities, including CVE-2026-68820. Previous coverage noted that Lazarus Group had exploited similar AFD.sys flaws in 2024 and 2025. The 'Operation Dream Job' campaign has been active since 2022, using social engineering tactics to target critical infrastructure sectors.

How outlets are covering it

BleepingComputer and The Hacker News emphasize the active exploitation of CVE-2026-68820 by Lazarus Group, highlighting the use of the FudModule rootkit and the Troy backdoor. Check Point Research provides detailed technical analysis of the infection chains, including DLL side-loading and trojanized PDF viewers, and notes the use of post-quantum cryptography in the LPE loader. Krebs on Security contextualizes the patch within Microsoft’s broader August update, noting that only one of the 398 fixed vulnerabilities was a known zero-day. All sources agree on the targeting of the defense sector and the use of compromised infrastructure for command-and-control.

Why it matters

The exploitation of a zero-day vulnerability in a core Windows component highlights the ongoing threat posed by state-sponsored actors like Lazarus Group. The targeting of defense and aerospace firms underscores the strategic importance of these sectors in cyber warfare. The use of compromised legitimate infrastructure for command-and-control makes detection and mitigation more challenging, emphasizing the need for robust security measures and prompt patching.

What to watch

Organizations should ensure that all systems are patched with the August 2026 updates, particularly those running Windows 11 builds 26100 and 26200. Security teams should monitor for indicators of compromise related to the Troy backdoor and RelayShell web shell. Given the use of social engineering tactics, employees should be trained to recognize fraudulent recruitment offers and verify software through official channels.