The threat actor from North Korea, Lazarus Group, is responsible for the use of the zero day vulnerability in Microsoft Windows that is recently patched. The attack involves the delivery of an unknown backdoor targeting defense and aerospace companies across France, Germany, Brazil, and India.
The activity, per Check Point Research, is part of Operation Dream Job. This is a long-running cyber espionage and social engineering campaign orchestrated by Pyongyang-backed hackers.
Let me break down the Lazarus Group Operation Dream Job zero-day campaign and what organizations need to know.
Key Points on the Campaign
- The Lazarus Group used the Windows AFD.sys zero-day CVE-2026-68820
- The vulnerability was patched in Microsoft’s August 2026 Patch Tuesday
- The targets were defense and aerospace companies
- The victims are based in France, Germany, Brazil, and India
- The malware deployed is a new Trojan named Troy
- Job scams from LinkedIn are used as the lure
The Operation Dream Job Tactic
The Lazarus Group Operation Dream Job zero-day campaign uses a well-established social engineering approach:
The Lure:
- Attackers approach professionals on LinkedIn
- They pretend to be recruiters
- They build trust through conversation
- They offer fake-but-compelling job opportunities
The Targets:
- Defense and aerospace professionals
- Companies like Lockheed Martin and Enveil are impersonated
- High-value targets with access to sensitive data
The Goal:
- Steal sensitive data
- Install malware
- Gain persistent remote access
- Conduct long-term espionage
The Zero-Day Vulnerability
The Lazarus Group Operation Dream Job zero-day campaign exploited CVE-2026-68820:
Vulnerability Details:
- Privilege escalation flaw in Windows Ancillary Function Driver for WinSock
- The vulnerable file is AFD.sys
- CVSS score: 7.0
- Patched by Microsoft in August 2026
How It Was Used:
- Attackers used the flaw to gain SYSTEM privileges
- This allowed them to bypass security controls
- They could hide malicious activity from security tools
The Two Infection Sequences
The Lazarus Group Operation Dream Job zero-day campaign uses two parallel infection sequences:
Sequence 1: DLL Side-Loading
- Victims receive an encrypted archive
- The archive triggers a DLL side-loading chain
- A malicious DLL (libmupdf.dll) displays a bogus job description
- Stealthily downloads MISTPEN downloader
- MISTPEN communicates via Microsoft Graph API and OneDrive
- Retrieves reconnaissance and persistence modules
- Triggers the AFD.sys driver exploit
- Deploys ForestTiger (ScoringMathTea) backdoor
Sequence 2: Trojanized PDF Viewer
- Victims are directed to download SecurityPDF
- The website impersonates Enveil
- The PDF viewer monitors for a special marker in PDF documents
- If the marker is present, it decrypts and launches a payload
- The payload loads the Troy backdoor directly into memory
The Troy Backdoor
The Lazarus Group Operation Dream Job zero-day campaign introduces a new backdoor called Troy:
Troy Capabilities:
- Runs directly in memory
- Supports 17 operator commands
- Enables file enumeration
- Supports file upload and download
- Provides archive and exfiltration
- Allows interactive shell access
- Enables process termination
- Supports in-memory DLL injection
- Allows configuration updates
Memory-Only Execution:
- Troy runs entirely in memory
- No files are written to disk
- This makes detection more difficult
The MISTPEN Modules
The Lazarus Group Operation Dream Job zero-day campaign uses MISTPEN to load at least four modules:
GetInfoPlugin (Release_GetInfoPlugin_x64.dll):
- Profiles the host system
- Exfiltrates collected information
- Sends as a single wide-character string
PvPlugin (Release_PvPlugin_x64.dll):
- Collects host reconnaissance data
- Gathers details about running processes
- OneScreenCapture (OneScreenCapture64.dll):
- Takes screenshots of the current desktop
- Captures all monitors
- Transmits as JPEG images
LPE Loader:
- Gathers host information
- Generates new key material using ML-KEM (post-quantum key encapsulation)
- Uses the negotiated key during handshake
- Decrypts and runs FudModule
FudModule 3.1: The Kernel Rootkit
The Lazarus Group Operation Dream Job zero-day campaign employs an updated version of the FudModule kernel rootkit:
FudModule 3.1 Features:
- Tamper with Smart App Control
- Smart App Control verifies if a program is safe to run
- Sets VerifiedAndReputablePolicyState to zero
- Invokes NtSetSystemInformation to reload code integrity policy
What It Does:
- The attack chain gains SYSTEM privileges
- Injects MISTPEN into a SYSTEM process
- Runs with elevated privileges
- Operates away from security tools
History:
- FudModule has been used since at least 2022
- FudModule 3.1 is an improved version
- It allows tampering with Windows security features
The Infrastructure
The Lazarus Group Operation Dream Job zero-day campaign uses a sophisticated infrastructure:
Compromised Websites:
- Hijacks legitimate WordPress and SharePoint sites
- Uses vulnerable Roundcube webmail servers
- These serve as ForestTiger command-and-control servers
- Makes traffic harder to differentiate from normal web traffic
RelayShell Web Shell:
- Deployed on Roundcube servers
- Exploits CVE-2025-49113
- Enables command and response exchange via text files
Fraudulent Enveil Domains:
- envell[.]xyz
- enveil[.]online
- uxtramine[.]org
Compromised Organization:
- An already breached France-based organization
- Used to send phishing messages
- Bypasses reputation-based filters
What Organizations Should Do
The Lazarus Group Operation Dream Job zero-day campaign requires heightened awareness:
Immediate Steps:
- Apply Microsoft's August 2026 Patch Tuesday updates
- Prioritize CVE-2026-68820
- Verify software through official channels, not search rankings
Detection and Monitoring:
- Monitor for unusual PDF viewer activity
- Look for suspicious DLL side-loading
- Check for unauthorized Smart App Control tampering
- Monitor for unusual OneDrive or Graph API activity
Social Engineering Defense:
- Train employees on LinkedIn recruitment scams
- Verify recruiter identities
- Be suspicious of unsolicited job offers
- Verify software downloads through official channels
The Researcher's Warning
Sergey Shykevich, director of threat intelligence at Check Point Software, warned:
"What makes this campaign so dangerous is not only the zero-day vulnerability – but also how Lazarus wove legitimate, trusted infrastructure into every stage of the attack. They hid in plain sight, behind top-ranked search results, real vendor branding, and the reputation of organizations they had already compromised.
When the website, the download and the recruiter all appear authentic, the old advice to 'spot the phishing link' is no longer easily applicable. Staying safe now means assuming that trust itself can be counterfeited: patch the moment updates land, verify software through official channels rather than search rankings, and extend zero-trust thinking to the legitimate-looking sites and partners we interact with every day."
Conclusion
The cyber operation conducted by the Lazarus Group is known as Operation Dream Job. The main tactic used for the cyber operation is a zero-day exploit targeting defense and aerospace companies. The zero-day exploit was used to deploy the Troy backdoor.
Key takeaways:
- CVE-2026-68820 exploited as a zero-day attack
- Operation Dream Job relies on LinkedIn job offers scams
- Two infection sequences: DLL Side-Loading and Trojanized PDF viewer
- Troy Backdoor supports 17 operator commands
- FudModule 3.1 tampers with Smart App Control
- Infected infrastructure is used for Command and Control
Organizations are advised to install patches released by Microsoft in August 2026 without delay. Ensure that staff members are capable of identifying recruitment scams on LinkedIn.
Operation Dream Job launched by the Lazarus Group shows that even trust can be forged. Zero-trust is the way forward.
FAQ Section
What is the Lazarus Group Operation Dream Job zero-day campaign?
It is a cyber espionage campaign exploiting CVE-2026-68820, a Windows zero-day. This campaign targets companies from France, Germany, Brazil, and India in the defense and aerospace industry via the Troy backdoor.
What is CVE-2026-68820?
This is an AFD.sys driver elevation of privileges vulnerability which Microsoft has patched in August 2026 Patch Tuesday.
How does the attack work?
Attackers use LinkedIn fake job offers to lure victims. They use two infection sequences: DLL side-loading with MISTPEN or a trojanized PDF viewer delivering Troy backdoor.
What is FudModule 3.1?
It is an updated kernel rootkit that tamper with Smart App Control. This is because the malware would have elevated privileges and thus be difficult to detect.
What action should organizations take?
They should install Microsoft August 2026 updates. They should train employees on the recruitment scam. They should authenticate their software. Extend zero-trust thinking to all interactions.
