A newly patched vulnerability in Microsoft Windows is at the center of an intrusion chain attributed to the Lazarus Group. According to Check Point Research, the Lazarus Windows zero-day exploitation helped the attackers reach SYSTEM privileges and ultimately deploy a backdoor aimed at organizations in defense and aerospace, across countries including France, Germany, Brazil, and India.
The incident is not described as a one-off strike. It appears tied to a longer-running campaign known as Operation Dream Job, where attackers blend job-themed social engineering with malware delivery to compromise targets. The techniques include messages that impersonate recruiters and lure victims into opening malicious documents or installing tainted software components.
Operation Dream Job: job offers as the entry point
In the latest activity, Lazarus uses job-related lures to build credibility and reduce suspicion. The approach centers on fake-but-plausible recruitment outreach sent through professional platforms, with recruiters posing as legitimate company representatives.
Victims are then directed toward files that look harmless at first—such as a malicious PDF—or toward an installer masquerading as a PDF viewer. The goal is to get the victim’s system ready for follow-on actions that lead to backdoor deployment.
The Windows flaw behind SYSTEM access
Check Point links the next stage of the intrusion chain to a privilege-escalation issue tracked as CVE-2026-68820, with a CVSS score of 7.0. The flaw affects the Windows Ancillary Function Driver for WinSock, AFD.sys, and was addressed by Microsoft as part of the Patch Tuesday updates for August 2026.
Exploiting that weakness is described as a key step toward full control. After gaining SYSTEM-level capabilities, the attackers can run additional components with elevated privileges and reduce the likelihood of detection by security tools.
Two infection paths: DLL side-loading and a trojanized PDF viewer
The observed campaign includes two parallel ways to reach the backdoor stage. Both rely on the same overall theme: convince the victim to download and run something that ultimately triggers malicious code loading and privilege escalation.
1) DLL side-loading chain
In one sequence, victims are instructed to download an encrypted archive designed to trigger a DLL side-loading process. A malicious DLL—named libmupdf.dll—is used as part of the lure, including presenting a fake job description.
From there, the activity shifts in a more covert direction. The DLL is said to download and execute, in memory, a lightweight downloader called MISTPEN. Communication with attacker-controlled infrastructure is reported to use Microsoft Graph API and OneDrive, which can help blend malicious retrieval with legitimate cloud traffic.
After reconnaissance and persistence steps, the chain triggers the AFD.sys exploitation and deploys ForestTiger (also tracked as ScoringMathTea), which provides remote access to the compromised host.
2) Trojanized “SecurityPDF” viewer
The second path focuses on a tainted application labeled as a SecurityPDF PDF viewer. Victims are reportedly directed to download it from websites impersonating a vendor brand.
Once installed, the viewer monitors PDFs opened through it for a specific marker string:
“This document is encrypted with sumatrapdf reader!!!!!!!!!!!!”
If that marker appears, the software decrypts and launches an embedded payload. Check Point describes that embedded payload as responsible for loading a backdoor named Troy directly into memory.
The DLL component is also described as providing 17 operator commands to support operational tasks such as file listing, upload and download, archiving and exfiltration, interactive shell access, terminating processes, performing in-memory DLL injection, and updating configuration.
What MISTPEN loads: modules for discovery, screenshots, and cryptographic handling
Check Point also outlines several modules associated with MISTPEN, indicating a fairly comprehensive toolkit once initial access is obtained. At least four different modules are mentioned:
- GetInfoPlugin (Release_GetInfoPlugin_x64.dll), used to profile the host and exfiltrate the collected information as a single wide-character string.
- PvPlugin (Release_PvPlugin_x64.dll), used to gather reconnaissance data including details about running processes.
- OneScreenCapture (OneScreenCapture64.dll), used to capture screenshots of the current desktop across all monitors and transmit them as JPEG images.
- A local privilege escalation loader that collects host information, generates new key material using ML-KEM (a post-quantum key encapsulation mechanism), and then decrypts and runs a module referred to as FudModule.
This mix suggests the attackers are not only seeking access, but also aiming to understand the environment quickly and maintain operational flexibility after escalation.
Rootkit behavior and stealth at SYSTEM level
Beyond the zero-day itself, the chain includes stealth features. Check Point describes an updated version of a kernel-mode rootkit Lazarus has used repeatedly since at least 2022, with the intent to conceal malicious tooling from security software.
Operationally, the sequence is described as follows: the adversaries exploit the AFD.sys local privilege escalation vulnerability to obtain SYSTEM privileges. They then inject another instance of MISTPEN into a SYSTEM process, enabling the activity to run with elevated rights and away from casual inspection.
The newer component is described as FudModule 3.1, designed to improve on earlier versions by tampering with Smart App Control, a Windows feature meant to help verify whether programs are safe to run.
One described technique involves a SYSTEM-level msiexec.exe child process, where a remote stub sets a policy value to zero and invokes a Windows system call (NtSetSystemInformation) to trigger an in-place reload of the code integrity policy.
Trusted branding and compromised infrastructure
One of the most striking elements is not solely the vulnerability, but how the campaign makes detection harder by leaning on legitimacy. Rather than relying only on bespoke infrastructure, the attackers reportedly hijack compromised WordPress and SharePoint websites and vulnerable Roundcube webmail servers to act as command-and-control (C2) points.
Many Roundcube servers were reportedly vulnerable to CVE-2025-49113. In those cases, attackers used it to install an otherwise undocumented PHP web shell called RelayShell, enabling command exchange through text files.
In at least one instance, a France-based organization that had already been compromised was used to send phishing messages to new victims, potentially helping bypass reputation-based filtering.
Impersonation websites distributing “SecurityPDF”
Check Point also reports that the attackers created at least three websites impersonating Enveil to distribute the “SecurityPDF” viewer. The domains listed include:
- envell[.]xyz
- enveil[.]online
- uxtramine[.]org
It is not fully clear how these sites were integrated into the broader social engineering flow. However, the suspected pattern is that a phishing message first delivers the PDF, and then encourages the victim to download the viewer from one of these sites to open or view the document.
Why this matters: trust is the attack surface
Check Point frames the campaign as dangerous not only because it weaponizes a zero-day, but because it blends malicious steps into environments that look normal—such as search visibility, vendor-style branding, and the reputation of already compromised organizations.
As a result, the usual advice to focus only on spotting obvious phishing links becomes less effective. If the message, download page, and recruiter identity all appear authentic, victims may hesitate less or verify less thoroughly.
The recommended mindset is to patch quickly after updates land, verify software through official channels rather than ranking or search results, and extend zero-trust thinking not just to unknown senders, but also to the seemingly legitimate sites and partners employees interact with daily.
Conclusion
The reported intrusion chain shows how the Lazarus Windows zero-day exploitation of CVE-2026-68820 can become part of a broader, well-practiced social engineering operation. By combining job-themed lures, malicious PDF-related delivery, SYSTEM-level escalation, and stealth components, Lazarus aims to take complete control of compromised systems.
For defenders, the practical takeaway is straightforward: treat newly patched issues as urgent, harden processes around document handling and software verification, and assume that “trusted” branding and infrastructure can be counterfeited.
Source: https://thehackernews.com/2026/08/lazarus-exploits-windows-zero-day-to.html
