Critical Windows AFD.sys Zero-Day Exploited by Lazarus Group

Key Takeaways

• The North Korean-backed Lazarus Group is actively exploiting a critical zero-day vulnerability (CVE-2026-68820) in the Windows kernel’s AFD.sys driver.
• This exploitation is part of their “Operation Dream Job” campaign, targeting defense, aerospace, and aviation sectors globally.
• The attack deploys an advanced version of the FudModule rootkit, granting SYSTEM-level privileges and enabling stealthy operations.
• Microsoft issued a patch for CVE-2026-68820 on August 11, and immediate application of this update is crucial for Windows 11 builds 26100 and 26200.

Lazarus Group Leverages Windows Zero-Day in Sophisticated Attack Chain

New findings from Check Point Research reveal that the prolific North Korean state-sponsored threat actor, Lazarus Group, has been actively exploiting a zero-day vulnerability within the Windows kernel. This critical flaw, identified as CVE-2026-68820, resides in AFD.sys, the Ancillary Function Driver responsible for managing network sockets in the Windows operating system. The exploitation facilitates the deployment of an enhanced variant of their notorious FudModule rootkit.

Microsoft responded swiftly, releasing a patch for the vulnerability on August 11 as part of its regular Patch Tuesday updates, shortly after Check Point’s responsible disclosure.

Operation Dream Job: A Persistent Espionage Campaign

This discovery is integrated into a broader investigation by Check Point into the latest phase of “Operation Dream Job,” an extensive espionage campaign that Check Point has been tracking since early 2026. This recent iteration of the campaign has specifically focused on organizations within the defense, aerospace, and aviation sectors, with observed activity spanning Europe, India, Brazil, and other international regions.

A hallmark of Lazarus Group’s tactics, the attackers employ social engineering by impersonating recruiters and offering attractive job opportunities. This long-standing deception tactic is designed to entice employees at high-value targets into opening malicious files, thereby initiating the infection process.

Dual Infection Chains and Advanced Persistence

Check Point identified two distinct but equally effective infection chains used by the Lazarus Group:

DLL Sideloading Variant

The first method involves DLL sideloading. Victims receive an encrypted ZIP archive containing a legitimate, signed PDF viewer application. Alongside this, the archive includes a malicious DLL, named libmupdf.dll, and an encrypted payload disguised with a PDF extension. Upon execution, the sideloaded DLL surreptitiously extracts and decrypts the hidden payload in memory. Concurrently, a decoy document, such as a fake Lockheed Martin job description, is displayed to the victim, maintaining the illusion of a legitimate interaction.

Trojanized PDF Viewer Variant

The second infection vector utilizes a trojanized PDF viewer, dubbed “SecurityPDF.” This application, built upon the open-source MuPDF framework, has been modified to impersonate Enveil, a company specializing in privacy-enhancing technologies. To enhance the credibility of their deception and reduce detection rates, the attackers established SEO-optimized impersonation websites. These sites, which rank prominently for search terms like “Enveil SecurityPDF,” enable the separate delivery of the malicious viewer from the booby-trapped PDF, making it harder for security solutions to flag the initial stages of the attack.

MISTPEN Downloader and FudModule Rootkit

Both infection chains ultimately lead to the execution of MISTPEN, a lightweight, in-memory downloader first documented by Mandiant in 2024. MISTPEN leverages the Microsoft Graph API to retrieve additional malicious modules from attacker-controlled OneDrive storage, with all communications encrypted using AES.

Initially, MISTPEN deploys reconnaissance and screenshot modules to profile the compromised machine. Once the target is validated, a privilege escalation module is delivered, triggering the exploitation of CVE-2026-68820 in AFD.sys. Successful exploitation grants the attackers SYSTEM-level privileges, paving the way for the deployment of FudModule, Lazarus’s signature kernel-mode rootkit. FudModule, first observed around 2021, has previously been linked to another AFD.sys vulnerability, CVE-2024-38193.

The newly identified FudModule v3.1 variant retains its core sabotage capabilities, including stripping telemetry callbacks, disabling minifilters, terminating the NT Kernel Logger, and blinding over 90 ETW providers using a kill-list largely consistent with prior versions. Notably, this version replaces the dedicated Microsoft Defender-disabling routine with a more generic suppression engine for security products. It also introduces a new feature to tamper with Smart App Control by resetting its verified-and-reputable policy state.

Following privilege escalation, FudModule injects a new MISTPEN instance into a SYSTEM process, allowing the attackers to operate with extreme stealth, largely evading most EDR tools. Subsequently, the group deploys either ForestTiger, a well-known Lazarus backdoor, or Troy, a newly discovered modular implant. Troy features 17 commands and capabilities for file exfiltration, remote command execution, and in-memory DLL injection.

Command and Control Infrastructure

Instead of relying on dedicated servers, Lazarus Group has ingeniously routed command-and-control (C2) traffic through hijacked Roundcube webmail instances and compromised WordPress or PrestaShop sites. Many of the exploited Roundcube instances were vulnerable to CVE-2025-49113, a critical PHP deserialization flaw that the group exploited using leaked credentials obtained from the dark web.

These compromised servers host RelayShell, a novel PHP web shell. RelayShell facilitates operator commands to victims via a file-based messaging system, rather than direct command execution. This method helps the C2 traffic blend in with normal web activity, further hindering detection. Check Point identified at least 17 unique compromised relay nodes and observed the group utilizing VPN services like ExpressVPN to obscure their origins.

What You Should Do

• Immediately apply the August Patch Tuesday update to all Windows 11 systems, especially builds 26100 and 26200, to patch CVE-2026-68820.
• Organizations, particularly those in the defense, aerospace, and aviation sectors, should conduct thorough scrutiny of outbound network traffic to Roundcube and CMS-hosted infrastructure, as these may be acting as covert C2 relay points.
• Enhance employee training on social engineering tactics, particularly those involving enticing job offers, to prevent initial infection.
• Implement robust endpoint detection and response (EDR) solutions and ensure they are configured to monitor for suspicious kernel-level activity and file-based C2 communications.
• Review and strengthen email security gateways to detect and block malicious attachments and links associated with “Operation Dream Job” lures.
• Regularly audit and patch web applications, including Roundcube, WordPress, and PrestaShop installations, to mitigate vulnerabilities like CVE-2025-49113.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.