Lazarus Group exploits Windows kernel vulnerability to escalate privileges via fake job offers

Summary

The Lazarus Group has launched a new wave of its long-running Operation Dream Job campaign, utilizing a previously unknown Windows zero-day vulnerability to gain full system control over target machines. The attackers use sophisticated social engineering-posing as recruiters on professional platforms and direct messaging apps-to trick professionals in the defense and aerospace sectors into downloading malicious payloads.

The attack utilizes two distinct infection chains to deliver malware. One chain employs DLL sideloading to deploy the Mistpen downloader, while a second chain uses a trojanized PDF viewer named SecurityPDF to execute the Troy backdoor directly in memory. Both paths lead to high-privilege access through the exploitation of a flaw in the Windows Ancillary Function Driver for WinSock (afd.sys).

What happened

Since early 2026, North Korean-affiliated actors have been targeting aerospace and aviation organizations globally. The attackers present convincing job descriptions via PDF files or specialized software to establish an initial foothold. Once the victim interacts with these files, the malware begins reconnaissance before moving to escalate privileges.

The campaign relies heavily on hijacked infrastructure rather than dedicated attacker servers. Lazarus is using compromised Roundcube webmail deployments and CMS platforms as command-and-control (C&C) relays. These servers are often compromised via leaked credentials or existing vulnerabilities like CVE-2025-49113, making the malicious traffic appear more legitimate to network defenders.

Technical details

The campaign utilizes a critical vulnerability in afd.sys, tracked as CVE-2026-68820. This is a use-after-free issue that allows an attacker to trigger a race condition to gain System privileges. Microsoft released a fix for this flaw on August 11, 2026.

Two primary infection chains have been identified:

Chain 1: DLL Sideloading

• Victims download an archive containing a legitimate, signed PDF viewer, a malicious DLL, and an encrypted payload disguised as a PDF.
• The malicious DLL executes the Mistpen downloader in memory while displaying a decoy job description to the user.
• After reconnaissance and persistence are established, the afd.sys exploit is triggered.
• Mistpen then deploys ForestTiger, a known Lazarus backdoor, for long-term remote access.

Chain 2: Trojanized PDF Viewer

• Victims are directed to websites impersonating the privacy technology company Enveil to download "SecurityPDF."
• The modified viewer monitors any opened PDF files for a specific hidden marker.
• When the marker is detected, the application decrypts and launches the Troy backdoor directly into memory.
• Troy is a single DLL implant capable of 17 different commands, including file exfiltration, shell access, and process termination.

Affected products and fixed versions

Why this matters for defenders

The use of a kernel-level exploit like afd.sys allows attackers to bypass many standard security controls and gain the highest level of privilege on a Windows system. Furthermore, the deployment of the Troy backdoor-which includes rootkit capabilities-allows the actors to hide their presence from security software and tamper with Windows features designed to verify software integrity.

The reliance on compromised legitimate websites for C&C means that traditional IP or domain reputation filtering may fail, as the traffic originates from trusted webmail or CMS platforms.

Defender guidance

• Patching: Immediately apply the August Patch Tuesday updates to remediate CVE-2026-68820. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
• Endpoint Monitoring: Focus on detecting in-memory execution and DLL sideloading. Monitor for unusual child processes spawned by PDF viewers or unexpected activity within the afd.sys driver.
• Social Engineering Awareness: Instruct employees, particularly those in defense and aerospace roles, to treat unsolicited recruiting outreach via LinkedIn or direct messaging with extreme caution. Verify all job-related downloads through official corporate channels.
• Infrastructure Hygiene: If your organization hosts Roundcube or other CMS platforms, ensure they are patched against CVE-2025-49113 to prevent them from being used as part of a hijacked relay network.