North Korea’s Lazarus Group has been quietly exploiting a previously unknown Windows vulnerability — CVE-2026-68820 — to plant a rootkit and a custom backdoor on systems inside defense, aerospace, and aviation organizations across Europe and India. The flaw is a use-after-free bug in the Windows Ancillary Function Driver for WinSock (AFD.sys) that allows a locally authenticated attacker to escalate privileges all the way to SYSTEM level without any additional user interaction. Lazarus has been exploiting it since at least early July as part of a long-running espionage campaign called Operation Dream Job, in which fake recruitment offers are used to lure employees at target organizations into opening malicious files. In one documented case, the attackers compromised a French organization and used it as a staging point for spear-phishing attacks on additional targets.
Researchers at Check Point who uncovered the campaign found that Lazarus embedded the exploit for CVE-2026-68820 into an updated version of their FudModule kernel-mode rootkit — a tool specifically designed to disable endpoint detection software and tamper with security products. This latest variant adds Smart App Control tampering to its existing EDR-evasion capabilities. Once the rootkit was installed, the attackers deployed a new backdoor called Troy that supports 17 commands including file upload, download, and exfiltration, in-memory DLL injection, and remote process termination. The group also compromised vulnerable Roundcube mail server installations (using CVE-2025-49113) and deployed a PHP web shell called RelayShell on at least 17 servers to proxy malicious communications through legitimate infrastructure. Microsoft addressed CVE-2026-68820 in August 2026 Patch Tuesday. CISA has ordered all U.S. federal agencies to patch within two weeks.
How to check if you’re affected
Affected versions of Windows include all supported Windows 11 releases (builds 26100 and 26200 are specifically documented by researchers). Open Settings → Windows Update and confirm the August 2026 cumulative update is installed. Organizations running Roundcube mail servers should also check for CVE-2025-49113 patches and review server logs for the RelayShell web shell indicator of compromise (Check Point’s report includes a YARA rule).