Lazarus Group Exploits Windows Zero-Day CVE-2026-68820 in Operation Dream Job Attacks

The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched Microsoft Windows vulnerability, CVE-2026-68820, to deliver a new backdoor called Troy. The campaign, part of the long-running Operation Dream Job, targets defense and aerospace companies in France, Germany, Brazil, and India.

According to Check Point Research, the attacks use social engineering on platforms like LinkedIn, with fake recruiter profiles impersonating firms such as Lockheed Martin and Enveil. Victims are lured into opening malicious PDFs or installing a trojanized PDF viewer, leading to two parallel infection chains.

The first chain uses DLL side-loading with a malicious library (libmupdf.dll) that displays a fake job description while stealthily downloading a lightweight downloader called MISTPEN. MISTPEN communicates via Microsoft Graph API and OneDrive, retrieves reconnaissance and persistence modules, and triggers the AFD.sys exploit to gain SYSTEM privileges before deploying the ForestTiger (ScoringMathTea) backdoor.

The second chain involves a trojanized PDF viewer named SecurityPDF, distributed through websites impersonating Enveil. When a PDF containing a specific marker is opened, the viewer decrypts and launches an embedded payload that loads the Troy backdoor directly into memory. Troy supports 17 operator commands for file operations, shell access, and DLL injection.

The attack also employs an updated version of the FudModule rootkit (version 3.1), which disables Windows Smart App Control and uses post-quantum cryptography (ML-KEM) for key exchange. The campaign hijacks legitimate WordPress, SharePoint, and vulnerable Roundcube servers (CVE-2025-49113) for command-and-control, using a new PHP web shell called RelayShell.

Check Point’s Sergey Shykevich emphasized the campaign’s sophistication, noting that attackers hide in plain sight by abusing trusted infrastructure and authentic-looking websites. The advisory urges organizations to patch immediately, verify software through official channels, and adopt zero-trust principles.