North Korea's Lazarus group spent the first half of 2026 posing as recruiters to plant malware inside aerospace and defense companies, and along the way it burned a previously unknown Windows flaw to switch off the security tools watching it. Microsoft shipped the fix, now tracked as CVE-2026-68820, in its August 11 Patch Tuesday release.
The campaign was uncovered by Check Point Research, which reported the bug to Microsoft and published its analysis on August 11. The team says this wave of the long running Operation Dream Job campaign has concentrated on the defense sector in Europe and India, with a particular emphasis on companies in aerospace and aviation. An earlier wave of the same campaign went after European drone and defense manufacturers with trojanized open-source tools. Hours after the patch shipped, CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog, which puts US federal civilian agencies on a remediation deadline.
What is affected
CVE-2026-68820 is a use-after-free bug in afd.sys, the Windows driver that handles network sockets. Check Point says the driver keeps a small piece of state for each socket, and that two of its own code paths can act on that state at the same time, without synchronization, when several threads touch a socket at once. Win that race and one path reads memory the other has already released. The exploit turns that into the ability to read and write kernel memory, and from there into SYSTEM privileges, the highest level on a Windows machine. The sample Check Point recovered checks explicitly for Windows 11 build 26100 (24H2) and build 26200 (25H2), so older builds were not in scope for this particular exploit. Check Point reported the issue on July 28, Microsoft confirmed it on July 31 and assigned the CVE on August 5.
How the attack works
Targets receive a job offer, most likely through professional networking platforms or messaging apps, and are steered to an encrypted ZIP archive. In the older of the two chains Check Point observed, the archive holds a legitimate signed PDF viewer, a malicious libmupdf.dll that the viewer loads in place of the real library, and an encrypted payload disguised as a PDF. Opening it shows a decoy document, in one case a fake Lockheed Martin job description, while a downloader called MISTPEN runs in memory and pulls further modules from attacker-controlled files on OneDrive.
A newer chain, first seen in July 2026, ships a trojanized PDF viewer called SecurityPDF, built on the open-source MuPDF project. It watches for a marker string inside any PDF the user opens, and when it finds one it decrypts an embedded executable and runs it, delivering a previously undocumented backdoor that Check Point named Troy. To get the viewer onto machines, the group stood up at least three websites impersonating the privacy technology firm Enveil, some of which ranked as the top search result for relevant queries. Check Point stresses there is no indication that Enveil itself was targeted or compromised.
Once MISTPEN has profiled a host and established persistence, it loads the privilege escalation module that exploits CVE-2026-68820 and uses it to run FudModule, Lazarus' kernel-mode rootkit, with SYSTEM rights. Check Point says this build adds tampering with Smart App Control that it had not seen in publicly analyzed versions. The group's command-and-control traffic ran through compromised Roundcube and WordPress servers carrying a PHP webshell called RelayShell, with the Roundcube servers taken over using CVE-2025-49113. In at least one case a compromised organization in Western Europe was used to spear-phish further targets under its own good name.
What you should do
Apply the August 2026 Windows updates, and prioritize Windows 11 24H2 and 25H2 machines given the KEV listing. Roundcube operators should confirm CVE-2025-49113 is patched, because the group is using vulnerable webmail servers as relay infrastructure rather than as end targets. Employers in defense and aerospace should treat an unsolicited recruiter approach that ends in a downloadable archive as a live threat, and should be wary of any PDF viewer that arrives from somewhere other than the vendor.
Indicators
Check Point published a large indicator set alongside its report. Two of the command-and-control addresses are 135[.]181[.]67[.]203 and 135[.]181[.]185[.]158. Sample hashes from the trojanized viewer chain include 2b4987c07a3d9a9a5d1a9bf4efa3d1903e775090b611710edafdc92874265ca8 and 3a02d0d798e8d35555776886d92b20ff38a101c9ef7e0eebc8ce5d259516525a.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.