Lazarus Exploits a Windows Zero-Day to Gain SYSTEM Privileges

Campaign Targeting the Defense and Aerospace Sectors

Check Point Research attributes a cyber-espionage campaign targeting defense and aerospace companies in France, Germany, Brazil, and India to the Lazarus Group.

The activity is part of Operation Dream Job, which uses fraudulent job offers and LinkedIn outreach. The operators also pose as recruiters from companies such as Lockheed Martin and Enveil.

The campaign exploits CVE-2026-68820, a CVSS 7.0 zero-day, to elevate local privileges to SYSTEM. The vulnerability affects the Windows Ancillary Function Driver for WinSock, commonly known as AFD.sys.

Microsoft addressed the vulnerability in the August 2026 Patch Tuesday updates. The exact affected Windows versions have not been disclosed.

Two Chains Used to Deliver Backdoors

In the first technique, the victim downloads an encrypted archive that launches a DLL side-loading chain. The libmupdf.dll file displays a fake job description and loads the MISTPEN downloader into memory.

MISTPEN uses the Microsoft Graph API and OneDrive to retrieve reconnaissance and persistence modules, including:

• Release_GetInfoPlugin_x64.dll, which profiles the host;
• Release_PvPlugin_x64.dll, which focuses on the system and active processes;
• OneScreenCapture64.dll, which can capture all monitors and send JPEG images;
• a loader that collects data, generates cryptographic material using ML-KEM, and executes FudModule.

After exploiting AFD.sys, the attackers deploy ForestTiger, also known as ScoringMathTea, a backdoor for remote access.

A second chain uses a trojanized PDF viewer called SecurityPDF. Targets are directed to at least three websites impersonating Enveil; one appeared among the top results for the search query “Enveil SecurityPDF.”

SecurityPDF monitors opened documents and searches for the marker:

This document is encrypted with sumatrapdf reader!!!!!!!!!!!!

When it finds the marker, it decrypts the embedded payload and loads the Troy backdoor into memory. The malware supports 17 commands for enumerating files, transferring data, creating archives, opening interactive shells, terminating processes, injecting DLLs, and updating its configuration.

Rootkit and Evasion of Windows Controls

The campaign uses FudModule 3.1, an updated version of the kernel-mode rootkit used by Lazarus since at least 2022.

The component tampers with Smart App Control, the Windows feature that assesses program trustworthiness. In a child msiexec.exe process running with SYSTEM privileges, FudModule:

• sets VerifiedAndReputablePolicyState to zero;
• calls NtSetSystemInformation with class 0xA4 and option 0x10000000;
• forces the code integrity policy to reload.

The AFD.sys exploit also allows the attackers to inject an additional instance of MISTPEN into a SYSTEM process, making detection by security software more difficult.

The impact therefore includes local privilege escalation, in-memory execution, persistence, information gathering, screen capture, remote access, exfiltration, and process manipulation.

What to Check and How to Respond

The top priority is to install the Microsoft August 2026 Patch Tuesday updates addressing CVE-2026-68820.

Security teams should also look for:

• libmupdf.dll;
• Release_GetInfoPlugin_x64.dll;
• Release_PvPlugin_x64.dll;
• OneScreenCapture64.dll;
• anomalous msiexec.exe activity;
• the PDF marker associated with SecurityPDF;
• suspicious changes to Smart App Control;
• unusual OneDrive loads or calls to the Microsoft Graph API.

Organizations in the defense and aerospace sectors should pay particular attention to job offers received via LinkedIn and to documents or tools downloaded from domains impersonating legitimate companies.