Lazarus Group returns with a campaign aimed at defense and aerospace that combines kernel rootkit and social recruitment

The North Korean group known as Lazarus Group has again shown that it continues to improve intrusion techniques for the defence and aerospace industry. According to the research published by Check Point, the attackers took advantage of a newly-parked zero-day vulnerability on Windows (CVE-2026-68820) to scale privileges and, from there, deploy a chain of infections that culminates in the installation of new backdoors - called Troy and ForestTiger - and in the activation of a root kit in kernel mode to hide their presence. The initial vector was not an "explosive" explosion on the Internet, but an old social Trojan horse: false recruitment messages linked to the campaign known as Operation Dream Job, which attracts professionals with simulated job offers in real companies.

What happened (confirmed facts): Check Point attributes this wave to Lazarus and documents two parallel infection routes. In the first one, the victim download a encrypted file that triggers a chain of DLL side-rolling; a malicious bookstore called libmudf.dll shows a false job description while shooting in memory a download called MISTPEN. In the second, the victim installs a broken PDF viewer called "SecurityPDF" downloaded from sites that mimic Enveil's branding; that viewer detects a specific marker in documents (literal text) and, if found, disfigures and runs a payload in memory that loads the back door Troy. The local climbing explosion is CVE-2026-68820 against AFD.sys (Ancient Function Driver for WinSock) and was patched by Microsoft in the August 2026 updates. The final effort of the attacker is to achieve SYSTEM privileges, move its components to high-level processes and disable or mute security controls in the kernel by a module known here as FudModule (version 3.1).

How the chain works technically: the flow combines social engineering, user components (PDF / DLL), a memory download that communicates with legitimate cloud services (Microsoft GraphAPI and OneDrive) to recover modules and a kernel explosion to raise privileges. MISTPEN download and run recognition modules (host profiling and process listing), take screenshots and prepare the LPE loader execution that negotiates keys with ML-KEM (post-quantum algorithm) to decipher and run FudModule. FudModule 3.1 takes advantage of the kernel level access to alter the code integrity policy (including the manipulation of Smart App Control) by calling NtSetSystemInformation, allowing malicious charges to evade the protections that would normally block unverified binary.

Those who are affected and why it matters: the confirmed victims are defence and aerospace companies in France, Germany, Brazil and India; however, the methodology - false recruitment, use of legitimate infrastructure committed and exploitation of an LPE on Windows - is applicable to any organisation with technical profiles or valuable intellectual property. Total control over critical hosts allows exfiltering intellectual property, credentials, sensitive designs and establishing persistence for future espionage or sabotage campaigns.

Offensive practices that complicate detection: The attackers abused legitimate infrastructure committed: WordPress and SharePoint hacked, vulnerable Roundcube servers (CVE-2025-49113) hosting a web shell called RelayShell, and Microsoft cloud services to download payloads. By supporting the C2 in "reputable" domains and platforms or in already committed genuine sites, malicious traffic is mixed with normal traffic, reducing the effectiveness of rules based only on reputation or black lists.

What is confirmed and what is still in dispute: is corroborated by Check Point that the campaign used CVE-2026-68820 to raise privileges and that the initial delivery included false recruiters and cut PDF visors; also the components MISTPEN, Troy, ForestTiger and FudModule 3.1 were documented. The attribution to Lazarus is the evaluation of researchers and is based on indicators of tool, infrastructure and tactics, techniques and procedures (TTP); in cybersecurity the attribution always involves degrees of uncertainty and should be considered with that nuance. Specific details on how many systems were committed in total, the exact scope of exfiltered data and whether there was internal complicity in any of the organizations still do not appear public.

Actual and additional risks: The combination of a kernel LPE and the evasion of integrity policies means that malicious loads can perform high-level persistence difficult to remove without a complete system rearrangement. The use of legitimate cloud services for telemetry and download reduces the visibility of detection in networks that allow such traffic. In addition, infecting third-party servers to launch phishing increases the risk of loss of reputation for external suppliers and complicates defenses based on mailing lists or DNS, because emails can leave from "reliable" infrastructure.

What should you do now - concrete and immediate measures: apply Microsoft patches as a priority on all endpoints and Windows servers: the correction for CVE-2026-68820 was published in the August 2026 newsletter (via Microsoft Security Response Center). Check updates and hashes from official sources, not from search results or links to unsolicited messages. Disable or restrict OneDrive / GraphAPI for critical stations if not required and monitor the use of these APIs from privileged accounts.

Check indicators in your endpoints: presence of libmuddf.dll on unusual routes, binary names related to documented modules (MISTPEN, FudModule, ForestTiger, Troy), msiexec.exe processes that act as unexpected parents and changes in integrity policies (Smart App Control). Perform forensic analysis on suspicious systems, including memory overflow and search for in-memory modules. On public servers (WordPress, SharePoint, Roundcube) apply available patches, review file integrity and search for web shells like RelayShell; if you detect engagement, revoke credentials, do complete cleaning and consider restoring from clean backup.

Strengthen preventive controls: implement Application Control (WDAC / Smart App Control) with white lists signed by the organization, activate virtualization protections (HVCI) where possible, restrict accounts with local privileges and apply lower privilege principle. Train employees on the modus operandi of Operation Dream Job: independent verification of job offers (not responding to links), survey of recruitment profiles through corporate channels and avoid installing visors or software from pages found in search engines.

If you find signs of commitment, isolate the affected assets, preserve evidence, contact your incident response team and the relevant CERT or authorities. For technical information and patch tracking, consult Microsoft at https: / / msrc.microsoft.com and analyses of public threats such as those of Check Point at https: / / www.checkpoint.com / research /. Keeping updates up to date and treating confidence in channels as something that can be falsified are now essential steps to reduce the risk of such intrusions.