Tag: Windows Ancillary Function Driver for WinSock (AFD.sys)

Attack Groups

Lazarus Group Exploits Windows Zero-Day CVE-2026-68820 in Operation Dream Job Attacks

The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched Microsoft Windows…

afd.sys backdoor Check Point Research CVE-2025-49113

August 12, 2026

Cyber Products

AFD.sys: Windows Kernel Driver Targeted by Exploit

AFD.sys is a Windows kernel driver that provides Winsock functionality. It contains the privilege escalation vulnerability CVE-2026-68820, which was exploited by Lazarus…

afd.sys Kernel Driver privilege escalation Windows

August 12, 2026