**Lazarus Group Exploits Zero-Day to Target Defense Firms with Fake Job Offers**
*The North Korean threat actor leverages a newly patched Windows flaw and counterfeit recruitment campaigns to deploy a sophisticated backdoor.*
By Ravie Lakshmanan
August 12, 2026
Tags: Vulnerability / Cyber Espionage
—
The North Korean threat actor known as the **Lazarus Group** has been identified as the perpetrator behind a sophisticated cyber-espionage campaign that exploits a recently patched zero-day vulnerability in Microsoft Windows. The operation, dubbed **”Operation Dream Job,”** specifically targets defense and aerospace companies across France, Germany, Brazil, and India. The attackers deliver a previously unseen backdoor named **Troy** by masquerading as recruiters on professional platforms like LinkedIn.
### The Attack Methodology
The campaign’s core strategy relies on social engineering rather than technical brute force. Lazarus Group creates fake but compelling job advertisements for high-profile firms such as Lockheed Martin and Enveil. They then approach potential victims via LinkedIn, posing as recruiters to build trust. Once contact is established, they trick the target into opening a malicious PDF file or installing a trojanized PDF viewer.
This initial access vector exploits **CVE-2026-68820**, a privilege escalation flaw in the Windows Ancillary Function Driver for WinSock (AFD.sys). Microsoft patched this critical vulnerability as part of its August 2026 Patch Tuesday updates. The flaw (CVSS score: 7.0) allows attackers to escalate privileges and execute code with SYSTEM-level permissions.
### Two Infection Paths
Security researchers from Check Point Research have identified two distinct infection sequences used in this operation:
1. **DLL Side-Loading:** Victims are instructed to download an encrypted archive. This triggers a chain reaction where a malicious DLL (`libmupdf.dll`) is loaded to display a fake job description. This simultaneously downloads a lightweight downloader called **MISTPEN**. This downloader communicates with attacker-controlled servers via Microsoft Graph API and OneDrive, fetching modules that perform reconnaissance, establish persistence, and ultimately exploit the `AFD.sys` vulnerability to deploy the **ForestTiger** (also known as ScoringMathTea) backdoor.
2. **Trojanized PDF Viewer:** In this method, victims are lured to a website impersonating Enveil to download a fake application called **SecurityPDF**. Once installed, the application monitors for a specific marker in PDF files. When it detects the marker (“This document is encrypted with sumatrapdf reader!!!!!!!!!!!!”), it decrypts and launches an embedded payload directly into memory. This payload loads the **Troy** backdoor, which supports 17 commands for file manipulation, data exfiltration, shell access, and process control.
### Escalating Evasion Tactics
The Lazarus Group is leveraging an updated version of a kernel-mode rootkit to hide its activities from security software. This **FudModule 3.1** variant is particularly dangerous because it can tamper with Windows Smart App Control, a feature designed to verify the safety of applications before they run.
The attackers have also hijacked legitimate infrastructure to mask their operations. They are compromising WordPress and SharePoint websites, as well as vulnerable Roundcube webmail servers, turning them into command-and-control (C2) hubs. In some instances, they have exploited the CVE-2025-49113 vulnerability in Roundcube to deploy a PHP web shell called **RelayShell**, allowing them to exchange commands and responses via text files.
In a concerning twist, the campaign has, on at least one occasion, used a previously breached French organization to send phishing messages. This “island hopping” tactic helps the attackers bypass reputation-based email filters, making the phishing emails appear to come from a trusted, albeit compromised, source.
### Expert Analysis
Sergey Shykevich, Director of Threat Intelligence at Check Point Software, emphasized the campaign’s dangerous nature. “What makes this campaign so dangerous is not only the zero-day vulnerability – but also how Lazarus wove legitimate, trusted infrastructure into every stage of the attack,” he stated. “They hid in plain sight, behind top-ranked search results, real vendor branding, and the reputation of organizations they had already compromised.”
He warns that the “old advice to ‘spot the phishing link’ is no longer easily applicable” when the entire chain of trust—from the website to the software download—appears authentic.
### FAQ
**Q1: What is “Operation Dream Job”?**
“Operation Dream Job” is a long-running cyber espionage and social engineering campaign orchestrated by the Lazarus Group. It involves sending fake job offers to professionals on platforms like LinkedIn to steal sensitive data and install malware.
**Q2: Which vulnerability is being exploited?**
The campaign exploits **CVE-2026-68820**, a privilege escalation vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys). It was patched by Microsoft in August 2026.
**Q3: What is the name of the backdoor being used?**
The backdoor installed on compromised systems is named **Troy**.
**Q4: Which industries are being targeted?**
The primary targets are defense and aerospace companies.
**Q5: Which countries have been affected?**
The attacks have targeted companies in France, Germany, Brazil, and India.
**Q6: How do attackers gain initial access?**
Victims are lured via fake recruiter messages on LinkedIn and tricked into opening a malicious PDF or installing a trojanized PDF viewer that deploys the backdoor.
**Q7: What is FudModule 3.1?**
FudModule 3.1 is an updated version of a kernel-mode rootkit used by Lazarus Group. It allows attackers to tamper with Windows security features like Smart App Control to hide malicious tools.
—
### Conclusion
The “Operation Dream Job” campaign highlights a worrying evolution in cyber-espionage tactics. Lazarus Group is moving beyond simple phishing to create a fully fabricated ecosystem of trust. By compromising legitimate websites, exploiting zero-day vulnerabilities, and mimicking trusted brands, they create a scenario where traditional security cues fail. This serves as a critical reminder that defense requires more than vigilance against suspicious links; it demands a zero-trust approach to all digital interactions, rigorous patching protocols, and verification of software through official channels rather than search results.
