Lazarus hackers exploited Windows zero-day to target defense firms

Microsoft disclosed that North Korea's Lazarus Group is actively exploiting a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock, identified as CVE-2026-68820. This zero-day flaw allows attackers to escalate local privileges to SYSTEM level on Windows 11 systems, specifically builds 26100 and 26200, through a race condition triggered by a crafted application.

The exploitation is part of the "Operation Dream Job" campaign, which targets defense, aerospace, and aviation organizations in Europe and India via deceptive job offers. To maintain access, Lazarus updated its FudModule rootkit to leverage this privilege escalation and deployed a new PHP web shell named RelayShell on compromised Roundcube instances.