Lazarus Exploits Windows Zero-Day to Hit Defense Firms, Unleashing Rootkit and Backdoors
North Korean Lazarus hackers used a Windows use-after-free vulnerability (CVE-2026-68820) in AFD.sys to elevate privileges and deploy a kernel-mode rootkit (FudModule) plus a new backdoor (Troy) as part of the Operation Dream Job campaign targeting defense, aerospace, and aviation firms in Europe, India, and beyond, including attacks via compromised Roundcube instances and a RelayShell web shell; Microsoft patched the flaw as actively exploited, signaling a continuing, globally distributed intrusion effort.