Lazarus Group Exploits Windows Zero-Day to Target Defense Companies
North Korean hackers deploy a new backdoor targeting aerospace and defense sectors through sophisticated attacks.
1Lazarus Group's New Operation
The North Korea-linked Lazarus Group has exploited a new Windows zero-day vulnerability to distribute a previously unseen backdoor targeting defense and aerospace companies. Dubbed 'Operation Dream Job,' this long-running campaign uses fake job offers to lure professionals. Posing as recruiters from companies like Lockheed Martin and Enveil on LinkedIn, they build trust before delivering malware.
2The Zero-Day Exploit
The attacks target CVE-2026-68820 (CVSS score: 7.0), a privilege escalation flaw in Windows Ancillary Function Driver for WinSock ('AFD.sys'). Microsoft patched this vulnerability in its August 2026 Patch Tuesday updates. Victims are tricked into opening malicious PDFs or installing trojanized PDF viewers through fake recruiter messages.
3The Troy Backdoor
Victims unknowingly install a trojanized PDF viewer that deploys a new backdoor called 'Troy,' granting attackers remote access to bypass security controls and take full control of infected systems. The Lazarus Group has refined this method since 2022, demonstrating their evolving capabilities in cyber espionage.
4Advanced Rootkit Technology
The attack chain includes an updated version of a kernel-mode rootkit, 'FudModule 3.1,' which the Lazarus Group has used since at least 2022. This rootkit bypasses Windows' Smart App Control feature, allowing malicious tools to evade detection by security software and persist on compromised systems for extended periods.
5Fake Websites and Social Engineering
Attackers created at least three fake websites impersonating Enveil to distribute 'SecurityPDF,' a malicious payload. While the exact integration into the campaign is unclear, victims are likely coerced into downloading the trojanized PDF viewer from these sites to view documents sent via phishing messages.
6Command and Control Servers
Instead of building custom infrastructure, Lazarus hijacks compromised WordPress and SharePoint sites and vulnerable Roundcube webmail servers as command-and-control (C2) nodes. This tactic blends malicious traffic with legitimate web activity, making detection harder. Roundcube servers are exploited via CVE-2025-49113.
7RelayShell Web Shell
Attackers deploy 'RelayShell,' a previously undocumented PHP web shell, on Roundcube servers to exchange commands and responses via text files. In one case, a breached France-based organization was used to send phishing messages to new victims, bypassing reputation-based email filters.
8Cybersecurity Warnings
Sergey Shykevich, Check Point's threat intelligence director, emphasizes that the campaign's danger lies not just in the zero-day exploit but in Lazarus' use of legitimate infrastructure at every stage. Experts urge immediate patching, software verification through official channels, and adopting a zero-trust mindset even with seemingly legitimate sites.