North Korean-linked Lazarus hackers exploited a Windows zero-day vulnerability to target defence, aerospace and aviation organisations in Europe and India. Microsoft patched the flaw in its August 2026 security updates after confirming that attackers had already used it in the wild.
Lazarus used a Windows privilege-escalation flaw
The vulnerability, tracked as CVE-2026-68820, affects the Windows Ancillary Function Driver for WinSock, also known as AFD.sys. Microsoft described it as a use-after-free flaw that allows a locally authenticated attacker to gain SYSTEM privileges.
An attacker can exploit the issue by running a specially crafted application on a vulnerable device. The application triggers a race condition that can elevate the attacker’s privileges without requiring further user interaction.
Microsoft fixed the issue during August Patch Tuesday and marked it as actively exploited. Researchers believe the Lazarus Windows zero-day activity began in early July.
Fake job offers target defence-sector staff
The attacks form part of Operation Dream Job, a long-running Lazarus campaign that uses fraudulent recruitment offers to reach employees at selected organisations.
The latest campaign focused on companies involved in defence technologies, including surveillance sensors, drones and robotics. Check Point researchers observed targeting across Europe and India, with successful compromises reported in France and Germany.
In one case, Lazarus compromised an organisation in France and then used it to send spear-phishing messages to further targets. This approach can make malicious recruitment emails appear more credible because they originate from a legitimate business environment.
FudModule rootkit exploits the flaw
Check Point found that Lazarus added exploit support for CVE-2026-68820 to a new version of its FudModule kernel-mode rootkit. The exploit specifically targeted Windows 11 builds 26100 and 26200.
The group has previously exploited an AFD.sys zero-day to gain elevated privileges and deploy FudModule. The latest version retains earlier features designed to disable endpoint-detection telemetry and interfere with security products.
Researchers also found Smart App Control tampering capabilities in the updated rootkit. These changes can help the attackers operate more quietly on compromised systems and reduce the chance of detection.
New Troy backdoor expands attacker control
The campaign also deployed a new backdoor named Troy. The malware supports 17 commands that allow attackers to collect system and process information, manage files and run commands discreetly.
Troy can upload, download, delete and archive files for data theft. It can also terminate remote processes, inject DLLs into memory and alter its configuration or communication timing.
Check Point additionally observed scans targeting vulnerable Roundcube webmail installations. The attackers likely used leaked credentials to access Roundcube before exploiting CVE-2025-49113, an authenticated remote-code-execution vulnerability.
After gaining access, they deployed a PHP web shell called RelayShell. Researchers identified at least 17 servers infected with the tool.
Organisations should patch and verify recruitment messages
The Lazarus Windows zero-day campaign shows how a targeted phishing lure can lead to a deeper compromise when attackers combine it with local privilege escalation and rootkit tools.
Organisations should apply Microsoft’s August 2026 security updates as soon as possible. Security teams should also review systems for suspicious activity linked to FudModule, Troy and RelayShell.
Employees in sensitive industries should independently verify unexpected job offers, particularly messages that include files, links or requests to install software. Strong endpoint monitoring, credential protection and phishing-awareness processes can further reduce the risk.
0 responses to “Lazarus hackers exploited Windows zero-day to target defence firms”