North Korea’s Lazarus Group has been running a kernel-level intrusion campaign against defence, aerospace, aviation, and unmanned aerial vehicle manufacturers since at least early July. Check Point Research published technical findings on August 12, attributing the campaign to a fresh wave of Operation Dream Job, with the added detail that attackers held a working zero-day in the Windows kernel for roughly five weeks before Microsoft patched it.
The vulnerability, CVE-2026-68820, is a use-after-free race condition in AFD.sys — the Windows Ancillary Function Driver for WinSock, a kernel-mode component present in every modern Windows installation. Two competing threads can race to access socket state without proper synchronisation; timing the race correctly gives an attacker a kernel read/write primitive and, from there, full SYSTEM privileges. CVSS score is 7.0. Microsoft assigned the CVE on August 5 and shipped a fix in August Patch Tuesday on August 11. Any Windows 10 or Windows 11 endpoint that has not applied this month’s updates is still exposed.
The attack chain
The campaign opens with recruiter-themed spearphishing. Targets — typically engineers or technical staff at organisations working in defence supply chains or UAV development — receive credible-looking job offers. The lures carry trojanised PDF readers or document viewers that deploy MISTPEN, a known Lazarus implant used as an in-memory loader.
Once MISTPEN is running, it loads an LPE module built to exploit CVE-2026-68820. Successful exploitation drops the FudModule rootkit with SYSTEM privileges. FudModule is a kernel-mode rootkit Lazarus has used since at least 2022, updated here to explicitly support Windows 11 builds 26100 and 26200. At kernel level, FudModule can disable or blind common endpoint detection tooling before the post-exploitation payload arrives.
The final stage delivers either ForestTiger, a known Lazarus backdoor, or Troy — a new single-DLL implant not previously documented. Troy’s command set covers seventeen operations: file and directory enumeration, upload and download, arbitrary command execution, process termination, and DLL injection into running processes. That breadth suggests it is designed for durable, low-profile espionage rather than disruption.
Command and control
C2 traffic routes through hijacked Roundcube webmail servers and compromised WordPress or PrestaShop sites. These servers host RelayShell, a PHP web shell that relays operator commands through a file-based messaging system, keeping direct connections between Lazarus infrastructure and victim networks off the wire. The technique delays attribution and complicates incident response: SOC teams chasing outbound connections will find legitimate-looking sites rather than Lazarus-owned infrastructure.
Who is at risk
The targeting pattern is clear: organisations in defence supply chains, aerospace engineering, UAV development, and related technical sectors in Europe and India. The use of a kernel zero-day, combined with rootkit deployment before the main backdoor installs, reflects Lazarus’s willingness to invest significant capability in targets of high intelligence value. This is an espionage campaign, not a ransomware operation.
UK and European defence contractors, aerospace component manufacturers, and any firm working on UAV programmes should treat unpatched August Patch Tuesday endpoints as an active risk. Verify that CVE-2026-68820 has been applied. Check for MISTPEN indicators — Check Point’s report includes hash and network IOCs — particularly on engineering workstations where job-offer phishing is plausible.
The FudModule rootkit update for Windows 11 signals that Lazarus is actively maintaining its kernel-mode tooling for current operating system versions. Zero-days in AFD.sys have appeared in previous Lazarus campaigns; this is not a one-off opportunistic exploitation but a sustained capability investment in Windows kernel-level access.