Security researchers at Check Point have uncovered a fresh Lazarus Group operation that leans on a previously unknown Windows kernel vulnerability to plant an upgraded version of the group’s signature rootkit. The flaw, now cataloged as CVE-2026-68820, sits inside AFD.sys, the driver that handles network socket operations at the core of the Windows kernel. Microsoft closed the hole in its August 11 Patch Tuesday release, just days after Check Point privately reported it.

The find is the latest chapter in Operation Dream Job, a North Korean espionage campaign that Check Point has been tracking since early 2026. This wave zeroes in on the defense, aerospace, and aviation industries, with victims identified across Europe, India, Brazil, and elsewhere. As in past iterations, the attackers approach targets posing as recruiters dangling attractive job offers — a tactic Lazarus has leaned on for years because it reliably gets employees at sensitive organizations to open a file they shouldn’t.

Two Roads Into the Same Trap

Check Point identified two separate infection paths that both lead to the same outcome. The first hinges on DLL sideloading: victims are sent an encrypted archive containing a legitimate, digitally signed PDF viewer bundled with a malicious library and an encrypted payload disguised as a PDF. When the victim opens what looks like a normal document, the sideloaded library quietly decrypts and runs the hidden payload in memory while a decoy file — in one case a fake Lockheed Martin job listing — keeps up appearances.

The second path is more elaborate. The attackers built a trojanized PDF viewer called SecurityPDF, based on the open-source MuPDF project, and dressed it up to impersonate Enveil, a real privacy-technology company. They went as far as seeding search-optimized decoy websites that rank well for searches related to the fake tool, letting them hand out the poisoned viewer separately from the booby-trapped document itself — a small extra step that makes the campaign harder to spot and take down.

From Foothold to Kernel Takeover

Both infection chains ultimately hand control to MISTPEN, a lightweight downloader Mandiant first documented in 2024. MISTPEN quietly pulls additional attack modules from attacker-controlled OneDrive storage over encrypted channels, disguising its traffic as ordinary use of the Microsoft Graph API. It starts by deploying reconnaissance tools to profile the compromised machine, and once the operators decide the target is worth pursuing further, it delivers a module built specifically to trigger the AFD.sys flaw.

Successful exploitation of CVE-2026-68820 grants SYSTEM-level privileges, the highest tier of access on a Windows machine, and clears the way for FudModule, the kernel-mode rootkit Lazarus has used since around 2021. Check Point is calling this build FudModule v3.1, and it carries over the tool’s core sabotage playbook: stripping telemetry callbacks, disabling security minifilters, killing the built-in NT Kernel Logger, and blinding upward of 90 Event Tracing for Windows providers that many detection tools rely on to see what’s happening on a system.

Why This Matters

FudModule has a track record of showing up in some of Lazarus’s most consequential intrusions, and its ability to disable Windows’ own logging and monitoring infrastructure makes post-compromise detection extremely difficult. Pairing that capability with a genuine zero-day, rather than a previously patched bug, meant defenders had no signature or patch to rely on until Check Point’s disclosure reached Microsoft.

This is also not FudModule’s first rodeo with AFD.sys. A separate use-after-free bug in the same driver, CVE-2024-38193, was exploited by the same rootkit family roughly two years earlier, suggesting the driver’s complexity continues to make it an attractive target for kernel-level attackers.

What Organizations Should Do

• Apply Microsoft’s August 2026 cumulative update immediately to remediate CVE-2026-68820.
• Treat unsolicited recruiter outreach carrying attachments or links with heightened suspicion, particularly in the defense, aerospace, and aviation sectors.
• Audit endpoint detection and response tooling for gaps in ETW provider coverage, since FudModule specifically targets these logging pathways.
• Monitor for unusual Microsoft Graph API traffic or unexpected OneDrive connections from endpoint processes, a known MISTPEN command-and-control pattern.
• Restrict execution of unsigned or newly downloaded DLLs alongside trusted, signed applications to reduce the risk of sideloading attacks.

Check Point’s disclosure underscores how nation-state actors continue to pair patient social engineering with genuine zero-day research, turning a single successful phishing interaction into full kernel-level compromise. Organizations in targeted sectors should treat this campaign as an active threat rather than a historical curiosity, since the underlying tradecraft — fake recruiters, trojanized viewers, and rootkit-grade persistence — is likely to resurface in new forms.