Lazarus Exploited a Windows 0-Day to Attack Defense Firms

The North Korean hacking group Lazarus exploited a Windows zero-day vulnerability (CVE-2026-68820) to attack defense-sector companies. This was reported by Check Point researchers tracking a new wave of the long-running Operation Dream Job campaign.

Microsoft patched the vulnerability in its August Patch Tuesday release, flagging it as actively exploited. According to the researchers, Lazarus had been using it since early July. The flaw is a use-after-free bug in the Windows Ancillary Function Driver for WinSock (AFD.sys) that lets a locally authenticated user run a specially crafted application, trigger a race condition and gain SYSTEM privileges without any user interaction.

Lured in with fake job offers

This latest wave of Operation Dream Job targets organizations in the defense, aerospace and aviation industries across Europe and India. The campaign's classic technique is bogus job offers sent to employees of the companies the attackers are interested in. In at least one case the attackers compromised an organization in France and used it for spear-phishing new victims.

Lazarus embedded the exploit for CVE-2026-68820, which supports Windows 11 builds 26100 and 26200, into a new version of its kernel-mode rootkit FudModule. In addition to its already known capabilities — disabling EDR telemetry and interfering with security products — the updated rootkit has learned to tamper with Smart App Control settings.

A new backdoor and a web shell

The attacks deployed a new backdoor called Troy that supports 17 commands: system and process reconnaissance; uploading, downloading, deleting and archived exfiltration of files; covert command execution; remote process termination; in-memory DLL injection; and changing the configuration and timing of server check-ins.

Separately, the researchers observed scanning for vulnerable Roundcube installations. After gaining access — likely via leaked credentials — the attackers exploited the PHP object deserialization vulnerability CVE-2025-49113 and installed a new web shell called RelayShell. In all, at least 17 servers infected with it were found.

According to Check Point, the campaign had a global reach: the activity spread to South America, including Brazil, while successful attacks were recorded in Western Europe — in France and Germany. The attackers showed particular interest in organizations tied to military technology: surveillance sensors, drones and robotics.

The researchers note that Lazarus continues to evolve toward more stealthy operations, adapting to the environment it targets. In this case, to disguise its malicious traffic the group used legitimate web infrastructure — compromised Roundcube servers. Check Point has published a list of indicators of compromise and a YARA rule for detecting RelayShell.

Source: Bleeping Computer