SURIQ
North Korea's Lazarus group has now run the same move two Augusts in a row: use a flaw in an obscure Windows networking driver to switch off endpoint defenses, then move in. On August 11, 2026, Microsoft patched CVE-2026-68820, a use-after-free bug in the Windows Ancillary Function Driver for WinSock (AFD.sys) that hands a local attacker SYSTEM privileges, the highest level on the machine. Check Point Research reported that Lazarus used it as a zero-day, meaning it was exploited before any fix existed.
The bug is only half the story. Check Point ties it to a fresh wave of Operation Dream Job, the long-running scheme where fake recruiters dangle jobs to get a foot inside defense and aerospace firms. Patching the driver closes the escalation, but the way in (a booby-trapped document viewer) and the payoff (a kernel rootkit that blinds security tools) both sit outside the patch. If you only apply the update, you have fixed one link in a six-step chain.
What Check Point found
According to Check Point, the current wave has been active since early 2026 and concentrates on the defense sector, with a stated focus on aerospace and aviation companies. The firm reports targets in western Europe (naming France and Germany), India, and activity reaching into South America, including Brazil. The lure is social: messages posing as recruiters on professional networks, steering the target toward a document that carries the job description.
From there, Check Point describes two delivery paths. In one, a legitimately signed PDF application is made to side-load a malicious library that decrypts and runs a hidden payload while showing a decoy document. In the other, victims download a trojanized viewer built on the open-source MuPDF reader, distributed through lookalike websites that, according to Check Point, impersonate Enveil, a real privacy-technology company, with some of the fake sites reported to rank highly in search results. Neither route requires the target to see anything obviously wrong.
- 1Fake recruiter lure
- 2Trojanized PDF viewerDetection point
- 3In-memory downloader beacons outDetection point
- 4Privilege escalation to SYSTEM
- 5Kernel rootkit blinds security toolsDetection point
- 6Backdoor and covert command channelDetection point
Check Point attributes the campaign to Lazarus based on overlaps in malware, tradecraft, and infrastructure. The reported toolkit includes an in-memory downloader the firm calls MISTPEN that beacons out over Microsoft's own OneDrive and Graph services, a new 64-bit backdoor named Troy, the FudModule kernel rootkit, and the well-documented ForestTiger backdoor for long-term access. To relay command-and-control traffic, the operators are said to have taken over third-party servers, in some cases exploiting an older Roundcube webmail flaw (CVE-2025-49113) on machines running vulnerable versions. This echoes the tradecraft we saw when North Korean operators ran their activity through trusted platforms rather than raw attacker infrastructure.
A 7.0 that mattered more than its score
Microsoft rates CVE-2026-68820 at 7.0, in the mid range, because it needs local access and wins a timing race inside the driver. That score is exactly why a bug like this gets deprioritized on a busy patch day. A nation-state actor used it anyway, as the pivot that turned a single compromised login into full control of the box. The lesson is one defenders keep relearning: exploitation status, not raw CVSS, should drive what you patch first. A 7.0 that a state group is firing in the wild outranks a quiet 9.8 that nobody has touched.
The disclosure timeline is tight. Check Point reports it flagged the flaw to Microsoft on July 28, Microsoft confirmed it on July 31, the CVE was assigned on August 5, and the fix shipped on August 11. The affected surface is broad: the NVD entry lists Windows 10 and 11 and Windows Server releases from 2012 through 2025.
The pattern: the same driver, the same rootkit, again
This is the part an advisory will not tell you. In August 2024, Microsoft patched CVE-2024-38193, a different use-after-free in the very same AFD.sys driver that Lazarus had used to load the very same FudModule rootkit. A year later, a new AFD.sys bug drives the identical outcome. AFD.sys is not an accident of this campaign; it is a driver the group returns to because it is present on every Windows host and sits at a privileged layer. FudModule is their off-switch for endpoint detection: once it loads in the kernel, it tampers with the security products watching the machine, so later stages run in the dark.
That repetition is the actionable signal. A defender who treats this as one more privilege-escalation CVE misses that the same actor keeps arriving at the same kernel-tampering capability through whichever driver bug is fresh. The durable defense is not chasing the specific CVE; it is watching for the behavior that follows it.
Patch today, then hunt the earlier stages
Install Microsoft's August 11, 2026 update to close CVE-2026-68820 across Windows and Windows Server. Do it on privileged and internet-facing hosts first. That removes the escalation Lazarus relied on. But because the operators blind endpoint tools once they reach the kernel, patching is not the same as knowing whether someone already walked this chain on your fleet. Hunt the stages that come before the exploit, where the activity is still visible:
-
Sideloaded document viewers. Look for a signed PDF application loading an unexpected library from a user-writable folder, or non-store builds of MuPDF-based readers appearing on staff machines.
-
Odd cloud beacons. A non-browser process reaching OneDrive or Microsoft Graph endpoints is worth a second look, since the downloader hides its traffic inside those trusted services.
-
Sensors going quiet. An endpoint agent that stops reporting, or an unexpected kernel driver load, can be the rootkit at work. Alert on your own telemetry falling silent, not just on what it sends.
-
Known infrastructure. Check Point published indicators including lookalike domains impersonating Enveil and relay-server addresses. Block and hunt them, but treat them as perishable: the domains and IPs rotate, so the behavioral signals above outlast any single list.
Two non-technical controls matter here too. Staff in defense and aerospace roles are the intended targets through job-offer messages, so social-engineering awareness and a policy against installing off-store document viewers cut the chain at step one. And when the on-host agent is the thing being disabled, detection that does not depend solely on that agent, with behavior mapped to MITRE ATT&CK and someone watching for the sensor to drop, is what closes the gap the rootkit opens.
Suriq is tracking this campaign. If you run Windows fleets in a targeted sector, patch CVE-2026-68820 now, then work backward through the chain above to confirm the earlier stages never ran.