Full Report
Key Points Introduction Since early 2026, Check Point Research has tracked a wave of the Operation Dream Job campaign. This wave primarily targeted the defense sector worldwide, with a particular emphasis on companies operating in the aerospace and aviation industries. We observed the threat actor distributing modified PDF viewers designed to execute malicious payloads embedded within specially […] The post Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack appeared first on Check Point Research.
Analysis Summary
# Threat Actor: Lazarus Group
## Attribution & Identity
* **Actor Identification:** Lazarus Group
* **Affiliations:** Democratic People's Republic of Korea (DPRK)
* **Associated Groups:** Linked to "Operation Dream Job" campaigns.
## Activity Summary
Since early 2026, the actor has conducted a wave of the **Operation Dream Job** campaign. This specific operation involves posing as recruiters from well-known defense and aerospace firms to deliver malware via trojanized applications and documents.
## Tactics, Techniques & Procedures
* **Social Engineering:** Approaching targets via professional networking platforms (e.g., LinkedIn) or messaging apps with fake job offers.
* **Search Engine Optimization (SEO) Poisoning:** Using impersonation websites and SEO to distribute trojanized applications and increase credibility.
* **Malicious Document Delivery:** Distributing "SecurityPDF," a modified PDF viewer designed to execute embedded payloads.
* **Exploitation (Zero-Day):**
* **CVE-2026-68820:** A zero-day Local Privilege Escalation (LPE) in the Microsoft `AFD.sys` driver used to gain SYSTEM privileges.
* **CVE-2025-49113:** Exploitation of Roundcube webmail servers to establish C2 infrastructure.
* **Defense Evasion:** Deploying the **FudModule** rootkit to disable Endpoint Detection and Response (EDR) visibility.
* **Infrastructure Hijacking:** Compromising WordPress and Roundcube servers to host relay shells, leveraging the reputation of legitimate organizations to send spear-phishing emails.
## Targeting
* **Sectors:** Defense, Aerospace, Aviation.
* **Geography:** Worldwide, with a primary focus on Europe (specifically Western Europe), India, and the defense sector globally.
* **Victims:** Personnel at aerospace and aviation companies; specific organizational names were not disclosed in the provided text.
## Tools & Infrastructure
* **Malware Families:**
* **Troy:** A new backdoor executed via the malicious PDF viewer.
* **FudModule:** A kernel-mode rootkit used for privilege escalation and EDR bypass.
* **SecurityPDF:** A modified, malicious version of a PDF viewer.
* **Infrastructure:**
* **RelayShell:** A PHP webshell used to turn compromised servers into C2 relay nodes.
* **C2 Nodes:** Compromised Roundcube and WordPress servers.
## Implications
The campaign demonstrates an advanced level of technical sophistication through the use of zero-day vulnerabilities and rootkits to bypass modern security defenses (EDR). By leveraging the "Dream Job" lure and hijacking the infrastructure of trusted organizations, the actor successfully exploits human trust and institutional reputation to facilitate further compromise.
## Mitigations
* **Patch Management:** Ensure all systems are updated with the August 2026 Microsoft security patches, specifically addressing **CVE-2026-68820**.
* **Software Verification:** Restrict the installation of PDF viewers and other productivity tools to known, enterprise-approved versions. Use application whitelisting.
* **Security Awareness:** Train employees (especially in defense/aerospace) to be skeptical of unsolicited job offers via LinkedIn or private messaging, particularly those requiring the download of specific viewing software.
* **Server Hardening:** Keep web-facing applications like WordPress and Roundcube updated to the latest versions to prevent exploitation of known vulnerabilities like **CVE-2025-49113**.
* **EDR Monitoring:** Monitor for unauthorized driver loading or attempts to manipulate kernel-mode processes, which may indicate rootkit activity.