In short: North Korea's Lazarus Group silently exploited a Windows zero-day, CVE-2026-68820, for at least five weeks before Microsoft patched it on August 11, 2026. The flaw is a use-after-free race condition in the Windows WinSock kernel driver (afd.sys) that enables full SYSTEM-level privilege escalation. Lazarus delivered the exploit via fake LinkedIn job offers targeting defense, aerospace, and aviation professionals. Their FudModule rootkit disabled 94 security monitoring channels on infected machines, leaving no alerts or visible traces. Install this month's Windows updates immediately.
What Happened
On August 11, 2026, Microsoft's August Patch Tuesday addressed 421 vulnerabilities, including CVE-2026-68820 in the Windows WinSock kernel driver — already being actively exploited in the wild. On the same day, CISA added it to the Known Exploited Vulnerabilities catalog with a federal remediation deadline of August 25 for all US civilian executive branch agencies.
Check Point Research discovered the vulnerability on July 28, 2026, reported it to Microsoft, and the CVE was formally assigned on August 5. By the time the patch shipped, Lazarus had been running the exploit for at least five weeks: a compiled FudModule rootkit artifact carries a timestamp of July 7, 2026 — giving the attackers a five-week head start before the fix existed.
How CVE-2026-68820 Works
The vulnerability is a use-after-free race condition in afd.sys — the Ancillary Function Driver for WinSock, the Windows kernel component managing socket operations for virtually every network-connected application. When two competing threads race to access socket state without proper synchronization, an attacker can corrupt freed kernel memory and obtain a read/write primitive, elevating privileges to SYSTEM — the highest access level in Windows. No additional user interaction is required once the exploit fires.
This is what makes the flaw particularly dangerous in combination with social engineering: Lazarus first achieves initial access through a malicious document (the fake job file), then uses CVE-2026-68820 to escalate to kernel-level control, bypassing most security tools. For context on social engineering tactics used in similar campaigns, see our post on remote access scams.
Operation Dream Job: When a Job Offer Becomes an Attack
Operation Dream Job is Lazarus's long-running espionage campaign, active since 2020. The playbook is consistent: a defense or aerospace professional receives a convincing LinkedIn message from a recruiter with a polished, months-old profile. To proceed with the interview, they are asked to download a technical assessment or job description — a PDF or .docx file with a hidden malware loader.
In the latest wave (July–August 2026), attacks were confirmed in France, Germany, India, and Brazil, targeting engineers and managers in defense systems, aviation, and critical infrastructure. CISA has previously warned that Lazarus invests significant effort in maintaining authentic-looking recruiter personas for months before deploying them — making them extremely difficult to distinguish from legitimate HR professionals.
FudModule and ForestTiger: What the Malware Does
After exploiting CVE-2026-68820, Lazarus deployed two tools on the victim's machine.
FudModule is a kernel-level rootkit. Its primary function is invisibility: it disables 94 ETW (Event Tracing for Windows) channels used by SIEM platforms, EDR solutions, and antivirus tools. In practice, it blinds the entire enterprise security stack from the inside — no alerts, no logs, no visible traces.
ForestTiger is a persistent backdoor providing long-term covert access. It collects device configuration data, running process lists, user credentials, and captures desktop screenshots, silently exfiltrating everything to Lazarus command-and-control infrastructure. Together, the rootkit and backdoor kept compromised systems under full attacker control for weeks with zero security alerts fired.
Who Is at Risk
CVE-2026-68820 technically requires local code execution first — the victim must run a malicious file. This reduces the risk for users who do not open unknown attachments. However, the realistic threat surface extends well beyond defense-sector professionals: fake job offers reach anyone actively job-seeking or open to opportunities on LinkedIn, email, or messaging apps. Now that the exploit is public, other threat actors can weaponize it in broader campaigns — any unpatched Windows system is at risk. LiMP VPN encrypts device traffic and masks your real IP address, limiting your network visibility and making your device harder to probe and fingerprint.
How to Protect Yourself Now
Install Windows updates immediately. Open Settings → Windows Update → Check for Updates. The CVE-2026-68820 patch shipped on August 11, 2026. If automatic updates are disabled, turn them on now — this is the most important step.
Treat unsolicited job offers with skepticism. If an unknown recruiter asks you to download a technical test or job description file, do not open it without verifying the sender through a separate channel. Lazarus invests months building convincing recruiter personas on LinkedIn.
Never run files from unverified sources. The entire attack chain starts with the victim executing a loader file — this is the one control point in your hands. Always verify the origin of any attachment before opening it.
Add a network privacy layer. LiMP VPN with its no-logs policy encrypts all device traffic and hides your real IP address, reducing the risk of network reconnaissance and data interception when connecting from public or untrusted networks.
Sources
- SecurityLab.ru — Zero-day in the Heart of Windows
- Check Point Research — Shattering the Dream: When a Job Offer Becomes a Zero-Day Attack
- BleepingComputer — Lazarus hackers exploited Windows zero-day to target defense firms
- SecurityWeek — August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day