Full Report
North Korean hackers have been exploiting a Windows zero-day vulnerability (CVE-2026-68820) to target defense-sector companies as part of the Operation Dream Job campaign. [...]
Analysis Summary
# Threat Actor: Lazarus Group
## Attribution & Identity
- **Actor Name:** Lazarus Group
- **Country of Origin:** North Korea (DPRK)
- **Known Aliases:** HIDDEN COBRA, APT38 (Note: specific sub-groups often overlap with these designations)
- **Associated Groups:** Historically linked to the Reconnaissance General Bureau (RGB).
## Activity Summary
The actor is currently conducting a wave of the long-standing **"Operation Dream Job"** campaign. Since early July 2026, Lazarus has been observed exploiting a Windows zero-day vulnerability to gain SYSTEM-level privileges on targeted workstations. The campaign utilizes fraudulent job recruitment offers to lure employees at high-value organizations into initiating the infection chain.
## Tactics, Techniques & Procedures
- **Social Engineering:** Leveraging fraudulent recruitment offers (Operation Dream Job) via spear-phishing.
- **Vulnerability Exploitation:**
- **CVE-2026-68820:** A zero-day use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys) used for Local Privilege Escalation (LPE).
- **CVE-2025-49113:** Authenticated PHP object-deserialization vulnerability in Roundcube used for Remote Code Execution (RCE).
- **Privilege Escalation:** Triggering race conditions to bypass Windows 11 (builds 26100/26200) security features.
- **Defense Evasion:**
- Disabling Endpoint Detection and Response (EDR) telemetry.
- Interfering with security products.
- Tampering with Windows "Smart App Control."
- Using compromised legitimate infrastructure (Roundcube servers) to tunnel traffic.
- **MITRE ATT&CK Techniques:**
- T1204.002: User Execution: Malicious File
- T1068: Exploitation for Privilege Escalation
- T1014: Rootkit
- T1562.001: Impair Defenses: Disable or Modify Tools
- T1505.003: Server Software Component: Web Shell
## Targeting
- **Sectors:** Defense, Aerospace, Aviation, Military Technologies (surveillance sensors, drones, robotics).
- **Geography:** Global reach including Western Europe (France, Germany), India, and South America (Brazil).
- **Victims:** Unnamed defense-sector companies; specifically mentioned a compromised organization in France used as a pivot for further attacks.
## Tools & Infrastructure
- **Malware Families:**
- **FudModule:** A kernel-mode rootkit used for privilege escalation and EDR bypass.
- **Troy:** A new backdoor supporting 17 commands (reconnaissance, file exfiltration, DLL injection).
- **RelayShell:** A PHP-based web shell used on compromised Roundcube servers.
- **Infrastructure:**
- Compromised Roundcube webmail instances used as relays.
- Use of leaked credentials for initial authentication to mail servers.
- *Note: Specific defanged IPs/domains were not provided in the source text, but the report mentions 17 identified RelayShell servers.*
## Implications
Lazarus continues to demonstrate a high level of sophistication by acquiring and weaponizing zero-day vulnerabilities (specifically targeting Windows 11). The transition toward using compromised legitimate web infrastructure (RelayShell) indicates a strategic shift toward stealthier, "living-off-the-land" communication methods to bypass network-level detection. Their focus on drone and robotics technology suggests a primary objective of intellectual property theft to bolster North Korean military capabilities.
## Mitigations
- **Patch Management:** Immediately apply Microsoft’s August 2026 security updates to address CVE-2026-68820.
- **Kernel Protection:** Monitor for unauthorized modifications to `AFD.sys` or attempts to load unsigned kernel-mode drivers.
- **Webmail Security:** Patch Roundcube installations to remediate CVE-2025-49113 and enforce Multi-Factor Authentication (MFA) to prevent credential abuse.
- **Employee Training:** Enhance awareness training regarding "Operation Dream Job" tactics, specifically focusing on unsolicited recruitment outreach via LinkedIn or email.
- **Detection:** Deploy the specific YARA rules provided by Check Point to scan for the RelayShell web shell and FudModule rootkit signatures.