North Korean Lazarus hackers exploited CVE-2026-68820, a zero-day vulnerability in the Windows Ancillary Function Driver (AFD.sys), to deploy their FudModule rootkit and gain SYSTEM privileges on defense-sector targets. Microsoft patched the flaw on August 11, 2026, following responsible disclosure by Check Point Research.
Consequently, organizations running Windows 11 24H2 and 25H2 builds are at risk if unpatched. The vulnerability has been under active exploitation since at least early July 2026 as part of the ongoing Operation Dream Job campaign.
What Happened: Lazarus Exploits Windows AFD.sys Zero-Day in Defense Sector Attacks
Check Point Research disclosed CVE-2026-68820 on August 11, 2026, alongside Microsoft’s August Patch Tuesday updates. The vulnerability is a use-after-free condition in the Windows Ancillary Function Driver for WinSock (AFD.sys). It stems from a race condition when multiple threads concurrently access socket state without proper synchronization.
Moreover, Lazarus actors leveraged this zero-day to deploy an updated version of FudModule, their kernel-mode rootkit. FudModule disables EDR visibility and grants SYSTEM privileges, enabling long-term stealthy access to compromised systems. The campaign primarily targeted defense, aerospace, and aviation organizations in Europe and India.
Furthermore, the threat actor combined this zero-day with sophisticated social engineering. Victims received fake job offers from impersonated companies via LinkedIn and messaging apps. These lures directed targets to download trojanized PDF viewers or malicious archives containing backdoors.
Technical Details of the CVE-2026-68820 Vulnerability
CVE-2026-68820 resides in AFD.sys, a kernel-level Windows driver responsible for managing network sockets. The flaw occurs when two code paths within the driver operate on socket state simultaneously without synchronization. Under specific timing conditions, one path accesses memory after another has freed it, creating a use-after-free vulnerability.
The exploitation chain observed by Check Point works as follows:
- Initial access: Spear-phishing via fake job offers impersonating defense-sector companies like Lockheed Martin and Enveil.
- Payload delivery: Two infection chains — DLL sideloading via a legitimate PDF viewer, or a trojanized PDF viewer named SecurityPDF.
- Reconnaissance: MISTPEN downloader deploys in-memory modules to collect system info, process lists, and screenshots.
- Privilege escalation: The LPE loader downloads FudModule, which exploits CVE-2026-68820 to achieve SYSTEM privileges.
- EDR bypass: FudModule v3.1 tears down telemetry callbacks, disables minifilters, and suppresses crash dumps.
- Persistent access: ForestTiger and Troy backdoors provide long-term remote access.
FudModule v3.1 specifically targets Windows 11 builds 26100 (24H2) and 26200 (25H2). It uses a kernel read/write primitive derived from the use-after-free to escalate privileges. The module also features a Smart App Control tampering capability not seen in previous versions.
The Infection Chains Used by Lazarus
In the first infection chain, victims download an encrypted ZIP containing a signed PDF viewer, a malicious DLL, and an encrypted payload. The DLL sideloads MISTPEN, which communicates via Microsoft Graph API and OneDrive. In the second chain, victims install SecurityPDF, a trojanized MuPDF viewer that executes encrypted payloads embedded in crafted PDF documents.
Additionally, the threat actor created impersonation websites for Enveil that ranked at the top of search results. This SEO-driven distribution separated the delivery of the trojanized viewer from the malicious PDF, reducing detection odds.
Business and Operational Impact
The Operation Dream Job campaign has broad implications for defense-sector organizations and their supply chains. The targeted sectors include:
- Defense and aerospace: Primary targets in Europe and India, including surveillance sensor, drone, and robotics firms.
- Trusted relationships: A compromised organization in France was used to launch further spear-phishing against new victims.
- EDR evasion: FudModule disables process, thread, image notify, object, registry, and minifilter callbacks across 94 ETW providers.
- Data exfiltration: Troy backdoor supports file upload/download, in-memory DLL injection, and interactive shell commands.
Therefore, the impact extends beyond the initial compromise. By abusing legitimate infrastructure and trusted relationships, Lazarus can access sensitive defense technologies, intellectual property, and supply chain partners.
Mitigation and Recommendations
Organizations should act immediately to reduce exposure to this threat. The following steps are recommended:
Immediate Actions for Defenders
- Patch immediately: Apply Microsoft August 2026 Patch Tuesday updates to address CVE-2026-68820.
- Block known IOCs: Monitor for MISTPEN, FudModule, Troy, and RelayShell indicators published by Check Point.
- Restrict OneDrive abuse: Monitor for unusual Microsoft Graph API activity and OneDrive file access from unknown clients.
- Harden PDF handling: Restrict execution of untrusted PDF viewers and block sideloaded DLLs via application control policies.
- Audit Roundcube servers: Patch CVE-2025-49113 and rotate credentials to prevent RelayShell C2 abuse.
Long-Term Defensive Measures
Implement network segmentation to limit lateral movement from compromised endpoints. Enforce application whitelisting to prevent execution of untrusted PDF viewers and DLLs. Deploy behavioral detection for kernel-level tampering and ETW provider suppression. Also, train employees to recognize spear-phishing lures, especially fake job offers on professional networking platforms.
Bottom line: CVE-2026-68820 is a serious zero-day actively exploited by a nation-state actor. Patching is critical, but defenders must also address the social engineering and infrastructure abuse that enable these attacks.
Incident Summary
| CVE ID / Incident: | CVE-2026-68820 — Microsoft Windows AFD.sys Use-After-Free |
| Threat Actor: | Lazarus Group (DPRK-linked) |
| Campaign: | Operation Dream Job |
| Affected Systems: | Windows 11 builds 26100 (24H2) and 26200 (25H2) |
| Severity: | Use-After-Free leading to Local Privilege Escalation (LPE) to SYSTEM |
| Disclosure Date: | August 11, 2026 (Patch Tuesday) |
| Patch Status: | Patch available via Microsoft August 2026 updates |
| Active Exploitation: | Confirmed since at least early July 2026 |
| Primary Targets: | Defense, aerospace, and aviation sectors in Europe and India |
References
- Check Point Research, “Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack,” August 2026, https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/ (accessed August 21, 2026).
- BleepingComputer, “Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days,” August 11, 2026, https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2026-patch-tuesday-fixes-400-flaws-3-zero-days/ (accessed August 21, 2026).
- CISA, “CISA Adds Four Known Exploited Vulnerabilities to Catalog,” August 18, 2026, https://www.cisa.gov/news-events/alerts/2026/08/18/cisa-adds-four-known-exploited-vulnerabilities-catalog (accessed August 21, 2026).
