Lazarus does a zero-day exploitt
The North Korean hacking group called Lazarus has been linked to the zero-day compromise of a recently patched vulnerability affecting Windows to deploy a new backdoor attacking aerospace and defense organizations throughout India, France, Brazil, and Germany.
Fake job postings to lure victims
According to Check Point Research, the attack is part of Operation Dream Job, a social engineering and cyber espionage campaign run by Pyongyang-backed threat actors to target job seekers globally with fake but promising job opportunities at organizations like Enveil and Lockheed Martin to steal important information and deploy malware by reaching out to professionals on forums such as LinkedIn, mimicking to be job recruiters to gain trust.
The attacks have been discovered to take use of CVE-2026-68820 (CVSS score: 7.0), a privilege escalation vulnerability that affects the Windows Ancillary Function Driver for WinSock ("AFD.sys"), which Microsoft fixed as part of their August 2026 Patch Tuesday upgrades.
As found in earlier campaigns, targets are trapped via fake recruiter messages and lured into opening an infected PDF or deploying a malicious PDF viewer, which then deploys a new backdoor known as Troy that allows remote access to the infected system. The main aim of these hacks is to take complete command of compromised computers and escape security mechanisms.
Since 2022, Lazarus, along with Dream Job, has been using the tried-and-tested trojanized PDF viewer technique to lure victims.
Experts found two separate parallel compromise sequence:
Trojanized ‘SecurityPDF’ PDF viewer
Here, targets are asked to download SecurityPDF from a site mimicking Enveil. When the PDF is installed, it looks for any PDF document opened via it for a particular marker. If it is present, the app decodes an embedded payload that loads a backdoor called Troy straight into memory.
DLL side-loading
Here, targets are asked to download an encoded archive that launches a DLL side-loading chain. The infected DLL is used to demonstrate a fake job posting trap, while it secretly downloads and runs in memory in a lightweight downloader called MISTPEN. The downloaders work with hacker controlled infrastructure via Microsoft Graph API and OneDrive to extract and run espionage and persistence modules and run the “AFD.sys” driver exploit, before installing ForestTiger, also called ScoringMathTea, which offers remote access to hosts.
Since 2022, the Lazarus group has been using the updated version of the known-kernel-mode rootkit in its attempt to hide the presence of malicious components from security softwares deployed on the host.
Read the original article: