Lazarus Group has folded a new Windows zero-day into its long-running Operation Dream Job campaign, using a local privilege escalation flaw to push a kernel-mode rootkit onto machines it had already reached through fake job offers, according to Check Point Research. CVE-2026-68820 is a use-after-free race condition in the Windows Ancillary Function Driver for WinSock (AFD.sys) that lets a locally authenticated process trigger a race and gain SYSTEM privileges. Microsoft patched it on August 11 as part of its August Patch Tuesday updates, five days after the flaw was reported and confirmed in late July. Check Point traced two infection chains built around the exploit: a trojanized PDF viewer, and a legitimate PDF reader sideloaded with a malicious downloader, both used against defense sector employees in Europe, India, and South America lured with impersonated aerospace and aviation job offers.
The privilege escalation step matters because it is the mechanism that turns a successful phishing click into full system compromise. Once the AFD.sys race condition executes, the campaign deploys FudModule, Lazarus’s kernel-mode rootkit, followed by the ForestTiger backdoor, giving the operators durable, high-privilege access rather than a limited user-level foothold. CVE-2026-68820 has no remote network vector on its own, and that is exactly why it deserves attention here: local-only elevation bugs routinely rank behind remote code execution flaws in patch triage, yet this is the second stage a nation-state actor is actively relying on to convert phishing into system-level control. A vulnerability management program that prioritizes purely by CVSS or internet exposure will systematically underrate the flaw an active campaign is actually using once initial access is achieved.
Security teams in defense, aerospace, and aviation, or any organization that has previously seen North Korean-linked activity such as the DPRK-linked npm package hijacks reported this year, should confirm the August AFD.sys patch is deployed and review endpoint telemetry for unexpected PDF viewer child processes. It follows the same persistence pattern CyberTech covered when Void Blizzard’s OWAReaper malware survived credential rotation inside Exchange mailboxes: initial access is rarely the hard part for a well-resourced state actor, staying resident afterward is.
Source: Check Point Research
