Lazarus Exploits Windows AFD.sys Flaw in Dream Job Campaign

Lazarus Group exploited CVE-2026-68820, a newly patched Windows privilege-escalation vulnerability in the Ancillary Function Driver for WinSock, to obtain SYSTEM privileges and deploy backdoors against defence and aerospace organisations. Check Point Research linked the activity to Operation Dream Job, the long-running campaign that uses convincing recruitment lures to target professionals.

The flaw affects AFD.sys, carries a CVSS score of 7.0, and was addressed in Microsoft’s August 2026 Patch Tuesday updates. The reported targets were located in France, Germany, Brazil and India. The operation combines social engineering with local privilege escalation, persistence and remote-access tooling.

Two delivery paths lead to elevated access

In one infection sequence, victims are persuaded to download an encrypted archive. A DLL side-loading chain loads a malicious library named libmupdf.dll, which displays a bogus job description while downloading and running the MISTPEN downloader in memory. MISTPEN uses Microsoft Graph API and OneDrive to retrieve reconnaissance and persistence modules, invoke the AFD.sys exploit and deploy ForestTiger, also known as ScoringMathTea.

A parallel route relies on a trojanized PDF viewer called SecurityPDF, distributed from websites impersonating Enveil. The application watches for a special marker in an opened PDF and, if it finds one, decrypts and launches an embedded payload that loads the Troy backdoor directly into memory. Check Point said the Troy DLL implant supports 17 commands, including file operations, archiving and exfiltration, shell access, process termination and in-memory DLL injection.

Rootkit and trusted infrastructure complicate detection

MISTPEN loads modules for host profiling, process reconnaissance and desktop screenshots. Its local privilege-escalation loader also generates key material with the ML-KEM post-quantum key encapsulation algorithm before decrypting and executing FudModule. The updated FudModule 3.1 rootkit obtains SYSTEM privileges, injects MISTPEN into a SYSTEM process and can tamper with Windows Smart App Control by changing its policy state and triggering a reload of the code-integrity policy.

The campaign also avoids relying only on purpose-built command-and-control infrastructure. Lazarus used compromised WordPress and SharePoint sites, plus vulnerable Roundcube servers, for ForestTiger communications. Some Roundcube instances were vulnerable to CVE-2025-49113 and were infected with the RelayShell PHP web shell, which exchanges commands and responses through text files. In one case, a previously breached organisation in France was used to send phishing messages to additional targets.

Patch speed and software verification are central controls

The operation shows how a familiar recruitment-themed lure can be paired with a Windows zero-day, a trojanized viewer and legitimate-looking web services. It also fits the wider pattern of attack chains involving ClickFix and software impersonation highlighted in ClickFix chains and software impersonation threats, where trusted-looking delivery mechanisms can undermine reputation-based filtering.

For businesses, the practical implication is to deploy the August 2026 Windows updates promptly, require software downloads through verified official channels, and ensure that recruitment-related attachments, viewer installations and unusual cloud-service activity receive security review.