Lazarus Exploits a Windows Zero-Day in a Fake Job Offer Campaign

Campaign Targets Defense, Aerospace, and Aviation

A new operation attributed to the North Korean Lazarus group uses fake job offers to compromise organizations in the defense sector. Active since early 2026, the campaign is linked to the broader Operation Dream Job.

Targets include aerospace and aviation companies in France, Germany, Brazil, and India, as well as additional organizations across Europe and India. The operators contact candidates through professional platforms and messaging apps, then persuade them to download seemingly legitimate documents or tools.

The exact versions of Windows and the other products involved have not been disclosed.

Two Infection Chains Deliver In-Memory Backdoors

One infection chain delivers an archive containing a PDF viewer, a malicious DLL, and an encrypted payload disguised as a document. DLL sideloading enables the in-memory execution of the Mistpen downloader while displaying a fake job description to the user.

After initial reconnaissance and persistence installation, the attackers exploit CVE-2026-68820, a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys). The flaw enables a race condition that can be used to obtain System privileges, the highest privilege level in the operating system. The ForestTiger backdoor is then installed.

The second chain uses SecurityPDF, a trojanized PDF viewer. The program searches PDFs opened on the computer for a hidden marker and, when it finds one, launches the Troy backdoor directly in memory.

Troy is a new DLL-based implant with 17 commands. Its capabilities include:

• system enumeration;
• file download and upload;
• data exfiltration;
• shell access;
• process termination;
• DLL injection.

Zero-Day Already Exploited and Patched by Microsoft

Microsoft patched CVE-2026-68820 on August 11 as part of its Patch Tuesday updates. CISA has also added the vulnerability to its Known Exploited Vulnerabilities catalog, a classification reserved for flaws exploited in real-world attacks.

The campaign also uses CVE-2025-49113, a remote code execution vulnerability used in command-and-control infrastructure and exploited since early June 2025. Compromised Roundcube servers and CMS platforms are involved; the affected versions of these components are unknown.

The infrastructure hosts RelayShell, a previously undocumented PHP web shell. The malware relays communications between infected endpoints and the operators through simple text files, making the traffic resemble normal communications generated by web services.

What Organizations Should Do

The priority is to immediately deploy the Microsoft update released on August 11 across all compatible Windows systems. CISA urged U.S. federal agencies to complete remediation within the following two weeks.

Security teams should also:

• look for indicators associated with Mistpen, ForestTiger, Troy, SecurityPDF, and RelayShell;
• inspect endpoints for unusual PDF viewers or DLLs loaded from unexpected directories;
• examine Roundcube servers and CMS platforms for modified installations;
• analyze anomalous text files and communications with compromised web infrastructure;
• investigate DLL injection, shell access, and unexpected file transfers;
• subject job offers and unsolicited download requests to rigorous scrutiny.

The risk is particularly high for the defense, aerospace, and aviation sectors, where the theft of technical documents and operational data can have strategic consequences.