Lazarus Just Exploited the Same Windows Driver It Weaponized Two Years Ago
CVE-2026-68820 is the fourth AFD.sys zero-day patched since 2022 — and the fourth to land in CISA's KEV catalog. This one delivered Lazarus's FudModule rootkit into defense-sector inboxes disguised as a dream job.
A driver Lazarus keeps coming back to
Microsoft's August 11, 2026 Patch Tuesday fixed 421 CVEs. Only one was flagged as actively exploited: CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver for WinSock — AFD.sys, the kernel-mode driver every Windows socket connection passes through. Check Point Research tied the exploitation to the Lazarus Group's long-running Operation Dream Job campaign, and the payload was a new build of FudModule, the North Korean group's signature kernel rootkit. That's not a coincidence worth glossing over: Lazarus used a zero-day in this exact same driver, to deploy the same rootkit family, two years ago.
Scores as of 2026-08-16live record →
What the bug actually is
Microsoft's own description is narrow: a locally authenticated, low-privileged attacker runs a specially crafted application that triggers a race condition, and the use-after-free (CWE-416) lets them elevate to SYSTEM. No user interaction is required, but attack complexity is rated High — Microsoft's language suggests reliably winning the race takes environment-specific setup, which is consistent with this being the second half of a targeted intrusion chain rather than a mass-exploited bug.
Not the first time — not even the third
CVE-2026-68820 is the fourth AFD.sys elevation-of-privilege zero-day Microsoft has patched since 2022, and — per our own KEV data — every single one of the four has ended up on CISA's Known Exploited Vulnerabilities catalog.
| CVE | Published | CVSS | CWE | EPSS | Public exploit code | Attributed exploitation |
|---|---|---|---|---|---|---|
| CVE-2024-38193 | 2024-08-13 | 7.8 | CWE-416 (UAF) | 27.4% / 97.9th pct | Yes | Lazarus / FudModule v3.0 (Gen Digital) |
| CVE-2025-21418 | 2025-02-11 | 7.8 | CWE-122 (heap overflow) | 1.5% / 72.7th pct | No | Not publicly attributed |
| CVE-2025-32709 | 2025-05-13 | 7.8 | CWE-416 (UAF, null-pointer variant) | 1.8% / 76.0th pct | No | Not publicly attributed |
| CVE-2026-68820 | 2026-08-11 | 7.0 | CWE-416 (UAF) | 0.33% / 26.1th pct | No | Lazarus / FudModule v3.1 (Check Point) |
The 2024 rerun
The parallel to CVE-2024-38193 is close enough to be uncomfortable. Gen Digital researchers found Lazarus exploiting that AFD.sys use-after-free in mid-2024 to load FudModule v3.0, a rootkit capable of disabling security tooling from kernel mode. Two years later, Check Point found Lazarus doing it again — same driver, same weakness class, an updated FudModule build.
Same driver, same rootkit family, two years apart
- CVSS 3.1 7.8 — use-after-free (CWE-416)
- Payload: FudModule v3.0
- Discovered/attributed by Gen Digital, who published a sparse attribution note with no IOCs
- Delivery chain not conclusively established by researchers
- Fixed August 2024 Patch Tuesday
- CVSS 3.1 7.0 — use-after-free (CWE-416)
- Payload: FudModule v3.1, built for Windows 11 builds 26100/26200, now also tampers with Smart App Control
- Reported to MSRC by Check Point Research on 2026-07-28, with a full campaign writeup and IOCs
- Delivery chain documented: fake recruiter → malicious PDF-viewer DLL or fake-vendor website
- Fixed August 2026 Patch Tuesday
How this build of FudModule got onto a target machine
Check Point's report describes a fresh wave of Operation Dream Job, Lazarus's long-running fake-recruiter campaign, active since early 2026 against defense, aerospace, and aviation organizations — with confirmed compromises in France, Germany, India, and Brazil, and a stated interest in surveillance sensors, drones, and robotics programs.
Operation Dream Job → CVE-2026-68820 → FudModule 3.1
- Fake recruiter approach (likely LinkedIn) — Offers a job at a well-known company
- Chain A: ZIP with real PDF viewer + malicious DLL — Opening the viewer silently side-loads the DLL
- Chain B: fake site impersonating Enveil — SEO'd site serves "SecurityPDF", a trojanized viewer
- MISTPEN in-memory downloader / crafted-PDF trigger — Initial foothold on the target host
- CVE-2026-68820 exploited — Local UAF race in AFD.sys wins SYSTEM
- FudModule 3.1 rootkit loads — Disables EDR telemetry, tampers with Smart App Control
- Troy backdoor / ForestTiger deployed — Troy: 17-command in-memory implant. ForestTiger: known Lazarus long-term backdoor
- C2 via hijacked Roundcube webmail (RelayShell) — Exploited via CVE-2025-49113; C2 riding on servers Lazarus doesn't own
Disclosure timeline
From first exploitation to patch
- Exploitation beginsReporting places the start of in-the-wild CVE-2026-68820 use in early July — roughly five weeks before a patch existed.
- Check Point reports to MSRCFull campaign writeup with IOCs and a YARA rule submitted alongside the vulnerability report.
- Microsoft confirms the issueThree days after Check Point's report.
- CVE-2026-68820 assigned
- Patch ships + CISA KEV additionAugust 2026 Patch Tuesday; per our internal index the CVE is flagged in_kev.
What to actually do
- Apply the August 11, 2026 cumulative update — Microsoft lists no workaround, so patching is the only remediation for CVE-2026-68820.
- The affected range is broad: every actively supported Windows 10 and 11 branch and Windows Server 2012 through 2025, across both client and server SKUs. Confirm the exact fixed build for your specific edition in Microsoft's own update catalog rather than assuming a single number applies fleet-wide — our source data shows minor build-number discrepancies between the CVE record and NVD's mirrored copy.
- If FudModule's Smart App Control tampering matters in your environment, don't rely on Smart App Control/WDAC as a sole control against a kernel-mode rootkit — this campaign specifically targets it.
- If you run Roundcube Webmail, confirm you're past 1.5.10 / 1.6.11 to close CVE-2025-49113, the unrelated bug this same campaign used to build C2 relay infrastructure.
- Because FudModule's whole purpose is disabling EDR telemetry, treat unexplained gaps or silence in endpoint logging — not just alerts — as a hunting lead on machines that were exposed to this campaign's phishing lures.
What we don't know
CVE and KEV data as of 2026-08-16