Lazarus Weaponizes Windows Zero-Day in Global Defense Espionage Campaign

Key points

• Lazarus Group exploited CVE-2026-68820, a privilege escalation flaw in the Windows AFD.sys driver, to gain SYSTEM access and deploy the 'Troy' backdoor.
• The attack is part of 'Operation Dream Job,' a campaign targeting defense and aerospace professionals in France, Germany, Brazil, and India via fake recruiter messages on LinkedIn.
• Victims were lured into opening malicious PDFs or installing a trojanized PDF viewer called 'SecurityPDF,' which was distributed through impersonating websites ranking high in search results.
• CISA mandated that federal agencies patch the vulnerability by August 25, 2026, noting that a device restart is required and no workaround exists.
• The campaign utilizes compromised Roundcube webmail servers and WordPress sites as command-and-control infrastructure, employing a PHP web shell called 'RelayShell' to hide malicious traffic.

Background

This incident follows a series of major Microsoft Patch Tuesday releases in 2026, where August's update addressed 398 vulnerabilities, including three zero-days. Previous coverage in August 2026 highlighted the initial disclosure of CVE-2026-68820 and the deployment of the FudModule rootkit. The broader context includes a surge in vulnerability discoveries aided by artificial intelligence, leading to larger patch volumes, though experts warn that AI-generated fixes often introduce new weaknesses if not tested by humans.

How outlets are covering it

Check Point Research, which first disclosed the vulnerability, emphasized the sophistication of the attack chain, noting that Lazarus wove legitimate infrastructure and top-ranked search results into the campaign to evade detection. They highlighted the use of a new FudModule version that disables Windows Smart App Control. CISA and Microsoft focused on the urgency of patching, with CISA setting a strict deadline for federal agencies. Automox and other security firms described the vulnerability as a 'step two' in an attack chain, requiring initial phishing access before the race-condition exploit could be triggered. Krebs on Security contextualized the single zero-day within a massive batch of 398 fixes, warning organizations not to rush patching without testing, despite the active exploitation.

Why it matters

The exploitation of a zero-day in a core Windows component like AFD.sys by a state-sponsored actor like Lazarus Group poses a significant risk to critical infrastructure and defense industries. The campaign's use of social engineering and compromised legitimate infrastructure makes traditional detection methods less effective, highlighting the need for zero-trust security models and immediate patching. The involvement of CISA underscores the severity of the threat to national security and the urgency for organizations to verify software sources and apply updates promptly.

What to watch

Organizations should immediately apply the August 2026 Patch Tuesday updates, particularly for CVE-2026-68820, as no workaround exists. Security teams should monitor for signs of the 'Troy' backdoor and 'ForestTiger' malware, as well as unusual activity on Roundcube and WordPress servers. Users should be educated to verify recruiter identities and download software only from official vendor channels, not search engine results. Continued monitoring for the use of compromised infrastructure as command-and-control nodes is essential.