Exploited in the wild Windows Lazarus group nation-state AFD.sys Check Point
Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack
CVE Tools coverage
Check Point Research has identified a new wave of the Operation Dream Job campaign, attributed to the DPRK-linked Lazarus group, which targets organizations in the European and Indian defense sectors. The attackers employed a zero-day vulnerability, CVE-2026-68820, in the Microsoft AFD.sys driver to escalate privileges and deploy their FudModule rootkit, effectively blinding endpoint detection systems.
Additionally, the threat actors compromised Roundcube webmail servers by exploiting CVE-2025-49113 to install RelayShell, a new PHP webshell used for command-and-control relaying. Microsoft addressed the kernel driver flaw during their August Patch Tuesday updates, so immediate remediation is recommended.
Key Points
- Check Point Research is tracking a long‑running campaign called Operation Dream Job, targeting organizations worldwide, with a particular focus on the defense sector. The campaign is affiliated to DPRK-linked Lazarus group and its latest wave focuses on the defense sector in Europe and India.
- In the latest variant of the Operation Dream Job campaign, the threat actor distributed SecurityPDF, a modified PDF viewer designed to open attacker-crafted PDF documents and execute a new backdoor which we named Troy.
- During the intrusion, the threat actor exploited CVE-2026-68820, a zero-day vulnerability in the Microsoft AFD.sys driver, to deploy a new version of FudModule, Lazarus’ kernel-mode rootkit. Following Check Point Research responsible disclosure, Microsoft released a patch as part of their August Patch Tuesday updates.
- Lazarus also used CVE-2025-49113 to exploit vulnerable Roundcube webmail servers. The compromised servers were infected with RelayShell, a PHP webshell that repurposes compromised web servers as relay nodes within the attacker’s command-and-control infrastructure.
- At least in one case, a compromised organization in Western Europe was leveraged to conduct a spear-phishing campaign, allowing the attackers to abuse the organization’s reputation and trust to target additional victims.…