Fresh reports from Check Point describe how Lazarus Group-linked attackers used a newly patched Windows zero-day to compromise victims. The campaign is tied to long-running lures aimed at job seekers, but the technical path through Windows components and follow-on backdoors shows a clear focus on stealth and privilege escalation.
Because the flaw was fixed quickly and added to public guidance for remediation, defenders have a narrow window to reduce exposure. If your organization touches defense, aerospace, or aviation supply chains, this is especially relevant.
Fake recruiting as the entry point
A key part of the operation is social engineering. Attackers posing as recruiters contact potential victims via professional platforms or direct messaging apps and persuade them to download a malicious payload.
Rather than relying on a single lure, the campaign appears to run multiple variations. In Check Point’s assessment, these “job offer” themes have been used repeatedly as part of the broader Operation Dream Job activity.
From lure to execution: a chained infection
One observed infection chain starts with an archive that ultimately leads to malicious code execution. The package includes a PDF viewer component, a malicious DLL, and an encrypted payload designed to look like a PDF file.
To get code running, the attackers use DLL sideloading so the next-stage downloader can execute in memory. At the same time, victims see a decoy job description, helping the threat blend into normal user behavior.
Once the downloader is running, the malware performs additional steps commonly associated with intrusion operations. Check Point reports follow-on reconnaissance and persistence before moving to exploit a Windows component that was previously unknown to defenders.
The Windows zero-day: CVE-2026-68820
The core escalation technique in this campaign targets the Windows Ancillary Function Driver for WinSock, known as afd.sys. The issue is categorized as a use-after-free vulnerability that allows attackers to trigger a race condition and gain System privileges.
This flaw is tracked as CVE-2026-68820. Microsoft addressed it in the August Patch Tuesday updates, and the US cybersecurity agency CISA added it to its Known Exploited Vulnerabilities (KEV) catalog.
CISA’s guidance urges federal organizations to patch quickly—within the next two weeks—highlighting that this problem was not merely theoretical.
After privilege escalation: ForestTiger deployment
With System-level access, the infection chain continues by deploying ForestTiger, described by Check Point as a known Lazarus backdoor. Backdoors like this are typically used to maintain control and support follow-on actions such as data access, command execution, and additional lateral movement planning.
In this case, the combination of a newly patched Windows zero-day, a modular next-stage toolset, and memory-focused execution suggests the attackers prioritized reliability and reduced traces on disk.
Second chain: trojanized PDF viewer and in-memory control
Check Point also details an alternate path. In the second infection chain, users are directed to a trojanized PDF viewer called SecurityPDF.
Instead of simply opening a document normally, SecurityPDF includes logic that checks for a hidden marker in any PDF file opened on the system. If the marker is present, it triggers direct execution of the next backdoor stage in memory.
Introducing Troy: a DLL implant with multiple operator commands
The memory-resident stage in this chain centers on a DLL implant named Troy. Check Point reports that Troy supports 17 operator commands, including capabilities such as:
- File enumeration and file download/upload
- Data exfiltration
- Shell access
- Process termination
- DLL injection
These functions show that the payload is not limited to one-off execution. Instead, it supports interactive control by an operator, allowing the attacker to adjust actions based on victim conditions.
Command-and-control infrastructure and web-facing components
Effective control requires reliable command-and-control (C&C). In the observed activity, Check Point notes the use of compromised infrastructure including Roundcube webmail deployments and CMS platforms.
Some of those web-facing systems are associated with vulnerabilities such as CVE-2025-49113, a remote code execution flaw reportedly exploited since June 2025. Using compromised web platforms can help attackers maintain access while making their traffic look more like normal web behavior.
RelayShell webshell behavior
Check Point also reports that the infrastructure includes RelayShell, a PHP webshell described as operating more like a communication relay than a traditional backdoor. Rather than responding through complex protocols, it exchanges commands and results through simple text files between endpoints and the operator.
This design may help reduce the complexity of the operator workflow and improve resilience across environments, depending on how the attackers manage and monitor the relay endpoints.
Targets: defense, aerospace, and aviation organizations
Check Point states that the new campaign has been active since early 2026 and focuses on the defense sector across multiple countries, with attention on aerospace and aviation organizations in Europe and India.
The reporting also points to targeting in countries including France and Germany, as well as Brazil and India. While the initial lure may focus on job seekers, the end goal appears to align with organizations that operate in higher-sensitivity sectors.
What security teams should do now
Check Point’s recommendations center on speed and disciplined validation. With a Windows zero-day now patched, defenders should prioritize installing the relevant August Patch Tuesday update.
Beyond patching, teams are advised to review indicators of compromise and strengthen scrutiny around recruitment-related outreach. In practice, this means treating unsolicited recruiting messages as potentially unsafe and applying the same caution you would use for any unverified download request.
Because the attacks combine social engineering, memory-based execution, and modular backdoors, preparedness depends on both endpoint hygiene and clear user communication.
Why this campaign matters
This activity is a reminder that “fresh” vulnerabilities can be paired with established social tactics. A newly fixed Windows weakness—CVE-2026-68820—was leveraged alongside job-themed lures, decoy content, and follow-on implants such as ForestTiger and Troy.
For organizations in defense, aerospace, and aviation, the takeaway is straightforward: keep systems updated, monitor for suspicious delivery chains, and reduce trust in unexpected recruitment downloads. When these elements are missing, attackers can turn a single click into System-level control.
Source: https://www.securityweek.com/fresh-windows-zero-day-exploited-in-north-korean-cyberattacks/
