The message arrived the way good news usually does. A recruiter, a well known name in aerospace, a role that paid better than the one you have. There was a PDF with the full job description, and to open it properly you needed their document viewer. That last step is where the whole thing turned.
Check Point Research has published the details of a campaign that used exactly that setup to break into defense, aerospace and aviation companies across Europe and India. The attackers were North Korea’s Lazarus Group, and the reason security teams are paying close attention is not the fake recruiter routine, which is decades old. It is what came after: a zero-day flaw in a Windows kernel driver that nobody outside the operation knew existed, used to hand the intruders SYSTEM privileges and then quietly switch off the tools that were supposed to notice.
afd.sys, the Windows Ancillary Function Driver for WinSock. It lets an attacker who already has a foothold escalate to SYSTEM. North Korea’s Lazarus Group was exploiting it in the wild for roughly five weeks before a fix existed, as part of a new wave of the long-running Operation Dream Job campaign. Check Point reported it to Microsoft on July 28, 2026. Microsoft assigned the CVE on August 5 and shipped the patch on August 11 in its August Patch Tuesday release. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a federal remediation deadline of August 25. If you run Windows, install the August updates now.The Job Offer Was the Attack
Operation Dream Job has been running in one form or another since 2020, and the premise has never changed. Pose as a recruiter, target people with security clearances or access to interesting engineering work, and turn their ambition into an attack surface. What changed this year is the delivery.
Check Point identified two infection chains running in parallel. The first is classic DLL sideloading. The victim downloads an encrypted archive containing three files: a legitimate, properly signed PDF viewer executable, a malicious DLL named libmupdf.dll, and an encrypted payload wearing a .pdf extension. Launch the signed executable, and Windows obligingly loads the attacker’s DLL alongside it. The DLL then does two things at once. It displays a genuine looking decoy document, in at least one case a Lockheed Martin job description, while decrypting and running a payload called MISTPEN entirely in memory. MISTPEN is a lightweight downloader that pulls its next stages from OneDrive using the Microsoft Graph API, which is to say it hides its command traffic inside a service almost every corporate network already trusts.
The second chain is newer and, frankly, more unsettling. Instead of attaching malware, the attackers pointed victims at a download page for a tool called SecurityPDF, hosted on sites impersonating Enveil, a real privacy technology company. SecurityPDF is a modified PDF viewer whose job is to open the attacker’s crafted documents and execute a new backdoor that Check Point named Troy. To boost credibility, the group leaned on search engine optimization so the fake pages would surface in ordinary searches. A victim who got suspicious, closed the email and went looking for the software independently could still land on the attacker’s page.
Before the payload runs in earnest, reconnaissance modules profile the machine and its running processes. If the target is not interesting, the operation stops there. That is why the campaign stayed quiet for so long. It was never spraying.
How the Timeline Actually Played Out
| Date | What happened | Defender status |
|---|---|---|
| Early 2026 | New Dream Job wave begins, aimed at defense, aerospace, aviation, drone and robotics firms | Unknown to the public |
| July 7, 2026 | Compile timestamp on a recovered FudModule rootkit sample, the earliest hard evidence of the exploit in use | No patch, no CVE, no detection signature |
| July 28, 2026 | Check Point Research reports the flaw to Microsoft | Still no patch |
| August 5, 2026 | Microsoft confirms the issue and assigns CVE-2026-68820 | Still no patch |
| August 11, 2026 | Fix ships in August Patch Tuesday; CISA adds the CVE to its Known Exploited Vulnerabilities catalog | Patch available |
| August 25, 2026 | Deadline for US federal civilian agencies to remediate | Two weeks from patch to mandate |
Count the gap between that July 7 timestamp and the August 11 patch and you get about five weeks of confirmed exploitation with no defense available. The real number is probably larger, since a compile date tells you when the tool was built, not when it was first used.
What CVE-2026-68820 Actually Does
The flaw lives in afd.sys, the Ancillary Function Driver for WinSock. It is the kernel-mode component that sits underneath the Windows Sockets API, which means it is involved any time an application touches the network. Every Windows machine has it. Almost nothing you run avoids it.
Technically it is a use-after-free, a class of bug where code keeps referring to a chunk of memory after that memory has been released. Win the race, get the freed memory reallocated with data you control, and the kernel ends up acting on your instructions. The outcome here is local privilege escalation: an attacker who is already running code as a normal user becomes SYSTEM.
Its CVSS score is 7.0, which looks unremarkable next to the 9-point remote code execution flaws that grab headlines. That score is doing the vulnerability a disservice. Privilege escalation bugs are the second half of nearly every serious intrusion. The first half, getting some code running as a regular user, is the part that phishing and fake job offers solve cheaply and reliably. A dependable local escalation is what turns one compromised laptop into full control of it.
afd.sys has been a repeat source of privilege escalation bugs, and Lazarus in particular has a documented history of hunting for kernel driver flaws to pair with its rootkit. The driver is old, complex, reachable from unprivileged user code and impossible to remove. That combination is exactly what an attacker looking for a reusable escalation primitive wants.FudModule Is the Part That Makes It Vanish
SYSTEM access is the means, not the goal. What the exploit is really there to deliver is FudModule, a kernel-mode rootkit Lazarus has been refining across several years and several zero-days. Version 3.1 turned up in this campaign.
FudModule is not built to steal anything. It is built to blind the software that would otherwise report what happens next. Running in the kernel, it reaches directly into the data structures Windows uses for telemetry and dismantles them. It zeroes EtwpActiveSystemLoggers inside the _ETW_SILODRIVERSTATE structure, which kills the NT Kernel Logger and every CKCL logging session in one move. Event Tracing for Windows is the pipe that most endpoint detection and response products drink from. Cut the pipe and the EDR agent keeps running, keeps reporting healthy, and sees nothing.
This is the uncomfortable part for anyone who treats an EDR dashboard as ground truth. A clean console does not mean a clean network. It can mean the sensor has been switched off from underneath.
Post-Quantum Encryption, Used by the Wrong Side
One detail from the research has drawn attention well beyond the usual security crowd. The campaign protected its communications using ML-KEM, the post-quantum key encapsulation mechanism formerly known as Kyber and standardized by the US National Institute of Standards and Technology.
ML-KEM exists because encrypted traffic captured today could, in principle, be decrypted years from now by a sufficiently capable quantum computer. Governments and enterprises have been slowly migrating to it for that reason. Lazarus appears to have reached the same conclusion faster than most of its targets, and applied it to the traffic between compromised defense contractors and North Korean operators. State-backed groups adopting standards-track cryptography before the institutions that wrote the standards finish deploying it is a genuinely new problem, and it means intercepted traffic that agencies might once have banked on cracking later is now likely to stay unreadable.
The Infrastructure Was Somebody Else’s
The command and control layer followed the same borrowed-trust logic as everything else. Rather than standing up their own servers, the attackers compromised legitimate Roundcube webmail and WordPress installations and planted RelayShell, a new PHP webshell that turns a hacked site into a relay node in their network. Some of those Roundcube servers were taken using CVE-2025-49113, a known flaw that had simply never been patched.
In at least one case, a compromised organization in Western Europe was then used to send spear-phishing to further targets. Mail arriving from a real company with a real reputation and real SPF records clears filters that a freshly registered domain never would. It is the same pattern that made a poisoned open source security scanner such an effective route into thousands of companies at once: attack the thing everyone already trusts, and let that trust carry you.
What To Do Now
| If you are | Do this |
|---|---|
| A home Windows user | Open Settings, go to Windows Update and install everything from August 11 or later. Windows 11 needs KB5121003; Windows 10 needs KB5120249. |
| Running an IT estate | Treat the August rollup as an emergency deployment, not a monthly one. It is in the CISA KEV catalog, which means confirmed exploitation, not theoretical risk. |
| In defense, aerospace or aviation | Assume you were in scope. Hunt for the indicators Check Point published, check for gaps in ETW telemetry, and review anything staff downloaded after a recruiter conversation. |
| Running Roundcube or WordPress | Patch CVE-2025-49113 if you somehow have not, and audit for unfamiliar PHP files. Your server may be relay infrastructure rather than a target. |
| Job hunting in tech | No legitimate employer needs you to install a special viewer to read a job description. That request alone is the tell. |
That last row deserves emphasis, because it is the only part of this chain an individual controls. Every technical layer here was sophisticated. The entry point was a person being asked to download something, which is the same weak spot behind most of the online scams that catch otherwise careful people. Recruiters send PDFs. They do not send PDF readers.
The Bottom Line
Microsoft’s August release closed more than 400 vulnerabilities, with 421 CVEs by SecurityWeek’s count, and this one flaw is the reason the update is urgent rather than routine. It follows a July rollup that was the largest Patch Tuesday Microsoft had ever shipped, and the pattern is getting hard to ignore: the volume keeps climbing, and the flaws that matter most keep being the quiet privilege escalations rather than the dramatic remote exploits.
Strip away the kernel internals and the post-quantum cryptography and what you have is a group that understood something plainly. The hardest part of breaking into a defense contractor is not the software. It is getting a smart, careful person to click once. Everything after that was engineering, and Lazarus had five weeks to do it while the rest of us had nothing to install.
