Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
Summary: Check Point Research attributed zero-day exploitation of CVE-2026-68820, a privilege escalation flaw in Windows AFD.sys patched by Microsoft in August 2026, to North Korea's Lazarus Group, which used it to deliver a new backdoor called Troy against defense and aerospace companies in France, Germany, Brazil, and India. The attacks are part of Operation Dream Job, luring victims through fake recruiter messages on LinkedIn and trojanized PDF viewers, then using an updated kernel-mode rootkit, FudModule 3.1, to gain SYSTEM privileges and tamper with Windows Smart App Control.
Why it matters: Check Point reported the flaw to Microsoft in late July 2026 but said it was familiar with a successful implementation of the CVE in early June, and the campaign hides its command-and-control inside compromised WordPress and SharePoint sites and vulnerable Roundcube webmail servers, so reputation-based filters see ordinary traffic.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-49113CVE-2026-68820
- Related
- CVE-2026-68820: Microsoft Windows Ancillary Function Driver for Win Sock Use-After-Free Vulnerability Known Exploited Vulnerabilities · Aug 11, 2026CVE-2025-49113: Round Cube Webmail Deserialization of Untrusted Data Vulnerability Known Exploited Vulnerabilities · Feb 20, 2026