CISA gives federal agencies two weeks to patch Microsoft bug exploited in DPRK campaign

1. Executive summary

CISA has ordered U.S. federal agencies to patch CVE-2026-68820 by 25 August 2026 following confirmed in-the-wild exploitation by North Korean Lazarus Group (MITRE G0032) in Operation 'Dream Job'. The vulnerability is a Winsock flaw (CVSS 7.0, severity 7/10) enabling local privilege escalation from low-privileged foothold to full SYSTEM control, exploitable via kernel-driver race conditions. Check Point researchers disclosed the bug after investigating a campaign targeting defence and aerospace sector job applicants in France, Germany, Brazil, and India — EMEA financial services organisations with overlapping supply-chain or contractor relationships to these sectors should treat this as a priority patch across all Windows endpoints.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 24: digital operational resilience testing — general requirements	Confirmed active exploitation of CVE-2026-68820 in the wild by a state-aligned APT prior to patch availability — this is not theoretical risk but a live threat requiring immediate resilience testing of Windows endpoint exposure.	Clients must verify patch deployment across all Windows estates and confirm detection coverage for the kernel-driver race abuse pattern described in §3.
DORA Art. 19: reporting of major ICT-related incidents to competent authorities	EMEA targets confirmed in France and Germany; if a client organisation or its contractors are compromised via this chain, the incident chain (phishing → backdoor → LPE → SYSTEM) constitutes a major ICT-related incident.	Clients with defence/aerospace supply-chain links in affected jurisdictions should prepare incident classification and reporting workflows now.

3. Technical analysis & attack chain

Confirmed attack chain (Operation 'Dream Job' wave leveraging CVE-2026-68820)

Initial contact: Lazarus Group operators impersonate recruiters for Lockheed Martin and privacy-tech firm Enveil on LinkedIn and other platforms, contacting targets working in defence sectors including surveillance sensors, drones, and robotics.
Payload delivery: Targets receive malicious PDF files disguised as job descriptions or recruitment materials. Opening the PDF enables a backdoor providing long-term remote access.
Reconnaissance: The deployed malware gathers information about the infected device before attempting privilege escalation.
Privilege escalation: The malware deploys an exploit for CVE-2026-68820, a Winsock vulnerability. The flaw allows an attacker who has already achieved a low-privileged foothold to escalate to complete control of the system — "the kind of control normally reserved for the operating system itself." The exploit involves kernel-driver race abuse. The vulnerability mechanism has been compared to an intruder slipping through a closing door to print their own all-access VIP badge.
Persistence and C2: The backdoor provides long-term remote access. Check Point reports that Lazarus wove legitimate, trusted infrastructure into every stage — hiding behind top-ranked search results, real vendor branding, and the reputation of already-compromised organisations.

Technical specifics

CVE: CVE-2026-68820
CVSS: 7.0 (severity 7/10) — per verified reference data
Affected component: Winsock (Windows Sockets API — the bridge allowing web browsers and applications to connect to the internet)
Exploitation type: Local privilege escalation (LPE) via kernel-driver race condition
Prerequisites: Attacker requires an existing low-privileged foothold on the target machine (achieved via phishing/social engineering in the observed campaign)
Impact: Complete system compromise — escalation from limited user to SYSTEM-level control
Prior component history: The same Winsock component was previously exploited in 2024 by Lazarus Group, per Automox CTO Jason Kikta. Check Point researchers initially believed this was a previously patched vulnerability but further testing confirmed it as a new, distinct bug.
CISA KEV: Added to CISA Known Exploited Vulnerabilities catalogue; federal agencies given until 25 August 2026 to patch.
No workaround available: A device restart is required after patching.

Attribution confidence: Lazarus Group (MITRE G0032) attribution is corroborated by both Check Point research and Automox commentary. Operation 'Dream Job' has been tracked by multiple vendors since 2020, including Google (2022) and ESET, with confirmed compromises in India, Poland, the U.K., and Italy. The current wave's targeting of France and Germany is reported by Check Point (single-sourced for this specific wave; verify before enforcement).

Geographic targeting: France, Germany, Brazil, and India (current wave). Historical targets: India, Poland, U.K., Italy. Sector focus: defence — surveillance sensors, drones, robotics, aerospace.

4. Mitigation & containment

P1 — Within 24 hours

Identify all Windows endpoints in scope. CVE-2026-68820 affects every Windows endpoint managed; there is no server-only or client-only narrowing in the source material.
Confirm whether your organisation or any contractor/supply-chain partner has staff in defence, aerospace, drones, robotics, or surveillance sensor sectors who may be targeted via LinkedIn recruitment lures.
Alert security operations and phishing-response teams to the Operation 'Dream Job' lure pattern: fake recruiters claiming to represent Lockheed Martin or Enveil, delivering malicious PDFs via LinkedIn or other platforms.

P2 — Within 72 hours

Deploy the Microsoft Patch Tuesday fix for CVE-2026-68820 to all Windows endpoints. A device restart is required — schedule reboot windows accordingly. There is no workaround.
Verify EDR/endpoint detection coverage for kernel-driver race condition abuse patterns. Per Automox CTO Jason Kikta: "This exploitation pattern is detectable, but only if your detection actually covers kernel-driver race abuse."
Review authentication logs and endpoint telemetry for systems that may have received PDF files from LinkedIn-sourced contacts in the past 90 days, particularly individuals claiming recruitment roles at Lockheed Martin or Enveil.

P3 — Within 7 days (by 25 August 2026 at latest)

Complete patch verification across the full Windows estate. Confirm reboot completion — the patch is not effective until restart.
Conduct retrospective review of any job-application-related phishing reports from the past 6 months to identify potential earlier-stage compromises.
Brief HR and recruitment-facing staff on the Operation 'Dream Job' social engineering pattern. The campaign exploits trust in legitimate recruiter infrastructure — standard "spot the phishing link" advice is insufficient per Check Point researchers.

5. Indicators of compromise

No atomic indicators of compromise (hashes, domains, IPs, file paths) are available in the source material.

Behavioural indicators

Behaviour	Where to observe	Confidence
LinkedIn contact impersonating Lockheed Martin or Enveil recruiter, sending PDF attachments	LinkedIn messaging, email gateways, endpoint file download logs	High — corroborated by Check Point research
PDF file execution leading to backdoor installation and long-term remote access	EDR process trees, network C2 beaconing patterns, persistent scheduled tasks or services	High — Check Point confirmed
Malware performing local device reconnaissance prior to privilege escalation attempt	EDR behavioural analytics, process execution chains (whoami, systeminfo, network enumeration)	Medium — consistent with described chain
Kernel-driver race condition exploitation attempt from low-privileged process	EDR kernel-mode telemetry, driver load events, race condition detection rules	Medium — described by Automox CTO; detection capability dependent on tooling
Privilege escalation from standard user context to SYSTEM	EDR privilege escalation alerts, Windows Security Event Log 4672/4673/4688	High — confirmed vulnerability mechanism

6. Detection

Insufficient indicators to author detection rules. The source material does not contain specific file hashes, mutex names, command-line strings, registry keys, C2 domains, or other artefacts suitable for YARA or Sigma rule construction. The behavioural indicators in §5 should be translated into EDR detection logic using your platform's behavioural analytics capabilities, focusing on: (a) PDF execution chains leading to reconnaissance tooling, (b) kernel-driver race condition patterns, and (c) privilege escalation from low-privilege to SYSTEM.

Threat actor context

Lazarus Group · G0032 · aka Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. …

7. Sources

The Record — "CISA gives federal agencies two weeks to patch Microsoft bug exploited in DPRK campaign" — https://therecord.media/cisa-gives-federal-agencies-two-weeks-to-patch-dprk-microsoft-bug — 2026-08-12
BleepingComputer — "CISA gives feds 3 days to patch Check Point VPN bug exploited as zero-day" — https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-check-point-flaw-exploited-by-ransomware-gangs/ (context only)
BleepingComputer — "CISA orders feds to patch actively exploited Oracle flaw by Saturday" — https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-oracle-flaw-by-saturday/ (context only)
BleepingComputer — "CISA: Splunk Enterprise flaw actively exploited, patch by Sunday" — https://www.bleepingcomputer.com/news/security/cisa-splunk-enterprise-flaw-actively-exploited-patch-by-sunday/ (context only)
SecurityWeek — "CISA Urges Immediate Patching of Exploited SharePoint Vulnerabilities" — https://www.securityweek.com/cisa-urges-immediate-patching-of-exploited-sharepoint-vulnerabilities/ (context only)
BleepingComputer — "CISA sets urgent deadline to fix Cisco flaw exploited in attacks" — https://www.bleepingcomputer.com/news/security/cisa-sets-urgent-deadline-to-fix-cisco-flaw-exploited-in-attacks/ (context only)

8. Adverse Trace position

CVE-2026-68820 is a confirmed-exploited, CVSS 7.0 local privilege escalation vulnerability in Winsock, actively leveraged by Lazarus Group (G0032) in Operation 'Dream Job' — a well-corroborated, multi-year campaign tracked by Google, ESET, and now Check Point. The two-stage exploitation requirement (phishing foothold → LPE) means the vulnerability amplifies an existing compromise rather than providing initial access, but the kernel-level SYSTEM escalation it enables represents a critical severity outcome regardless of the base CVSS. EMEA financial services clients are not the primary targeting sector, but the confirmed presence of targets in France and Germany, the use of legitimate infrastructure that defeats conventional phishing detection, and the applicability to every Windows endpoint make this a mandatory patch. The absence of a workaround and the requirement for a reboot elevate operational complexity. We will monitor for Check Point's full technical report release and any IOCs emerging from it, and will update this advisory if atomic indicators become available. Attribution to Lazarus Group is well-supported across multiple sources; the current wave's specific targeting claims are single-sourced to Check Point — verify before enforcement.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.