Fresh Windows Zero-Day Exploited in North Korean Cyberattacks

1. Executive summary

North Korean threat actor Lazarus Group (MITRE G0032) is actively exploiting a newly patched Windows zero-day, CVE-2026-68820, in a continuation of Operation Dream Job targeting the defense, aerospace, and aviation sectors across Europe and India. The campaign uses fake recruiter lures to deliver trojanized PDF software, ultimately deploying the ForestTiger backdoor and a new implant called Troy. Microsoft patched CVE-2026-68820 on August 11, 2026, and CISA has added it to the KEV catalog. EMEA financial services clients with defense-sector subsidiaries or shared infrastructure should treat this as an immediate patching priority and warn recruitment-facing staff of the social engineering vector.

2. Regulatory framing

3. Technical analysis & attack chain

Attribution: Lazarus Group (MITRE G0032). Attribution is based on Check Point research; the campaign is consistent with the known Operation Dream Job tradecraft.

Attack chain (two confirmed infection chains)

1. Initial contact: Attackers pose as recruiters on professional platforms or direct messaging applications, targeting job seekers with offers from well-known companies (one decoy used a Lockheed Martin job description).
2. Payload delivery — Chain 1: Victim downloads an archive containing a legitimate-looking PDF viewer, a malicious DLL, and an encrypted payload disguised as a PDF file.
3. DLL sideloading: The malicious DLL is sideloaded by the PDF viewer, executing the Mistpen malware downloader in memory while a decoy job description renders on screen.
4. Reconnaissance & persistence: Mistpen performs local reconnaissance and establishes persistence (specific mechanisms not detailed in source).
5. Privilege escalation: Exploitation of CVE-2026-68820, a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys). The bug triggers a race condition, granting the attacker System privileges.
6. Backdoor deployment: With elevated privileges, the ForestTiger backdoor (a known Lazarus tool) is deployed, giving attackers full control of the system.
7. Payload delivery — Chain 2: A second infection chain directs users to a trojanized PDF viewer called SecurityPDF. This tool searches for a hidden marker in any PDF file opened on the system; if the marker is present, the Troy backdoor is executed directly in memory.

Troy backdoor capabilities (new DLL implant)

• Supports 17 operator commands.
• File enumeration, download, and upload.
• Data exfiltration.
• Shell access.
• Process termination.
• DLL injection.

C2 infrastructure

• Attackers use compromised Roundcube webmail deployments and CMS platforms as command-and-control endpoints.
• Many of these servers are vulnerable to CVE-2025-49113, a Roundcube RCE flaw exploited since June 2025.
• Compromised servers are infected with RelayShell, a previously undocumented PHP webshell that functions as a communication relay between infected endpoints and the operator, exchanging commands and responses via simple text files.

Geographic targeting: France, Germany, Brazil, and India — primarily aerospace, aviation, and defense organisations.

Confidence caveat: The technical detail above is single-sourced (Check Point research, as reported by SecurityWeek and Help Net Security). Verify IOCs before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

• Apply the Microsoft August 2026 Patch Tuesday update to all Windows endpoints and servers. CVE-2026-68820 is in CISA KEV with a two-week federal remediation deadline; treat as immediate for EMEA clients.
• Block and monitor for the trojanized PDF viewer executable SecurityPDF across endpoint controls.
• Alert security operations and recruitment-facing staff to the Operation Dream Job social engineering pattern (fake recruiter outreach via professional platforms and messaging apps). Reinforce that unsolicited software downloads from recruiter contacts are prohibited.
• Hunt for afd.sys exploitation indicators: unexpected System-privilege process creation originating from PDF viewer processes.

P2 — Within 72 hours

• Audit perimeter for Roundcube webmail and CMS deployments; patch against CVE-2025-49113 if any are internet-facing.
• Scan web servers for the RelayShell PHP webshell — look for PHP files writing and reading text-based command/response files in web-accessible directories.
• Deploy EDR detections for DLL sideloading activity involving PDF viewer applications, particularly unsigned or anomalously signed DLLs loaded by PDF software.
• Review authentication logs for new device registrations or sessions originating from recruitment-platform referrals.

P3 — Within 7 days

• Conduct a retrospective review of any PDF viewer deployments across the estate; whitelist approved PDF software via application control.
• Validate that EDR rules cover the Troy backdoor's behavioural profile: file enumeration, shell execution, DLL injection, and outbound data transfer from PDF viewer process trees.
• Brief HR and talent acquisition teams on the campaign; establish a verification protocol for any third-party recruiter communications requesting software installation.

5. Indicators of compromise

No atomic indicators of compromise (hashes, IPs, domains) are available in the source material.

Behavioural indicators

6. Detection

rule Lazarus_OperationDreamJob_Troy_Backdoor {
    meta:
        author = "Adverse Trace"
        date = "2026-08-12"
        reference = "https://www.securityweek.com/fresh-windows-zero-day-exploited-in-north-korean-cyberattacks/"
        description = "Detects trojanized SecurityPDF viewer and Troy backdoor artefacts associated with Lazarus Operation Dream Job"
    strings:
        $pdf_viewer = "SecurityPDF" nocase
        $marker_search = "PDF" nocase
    condition:
        $pdf_viewer and filesize < 5MB
}

rule Lazarus_OperationDreamJob_RelayShell_Webshell {
    meta:
        author = "Adverse Trace"
        date = "2026-08-12"
        reference = "https://www.securityweek.com/fresh-windows-zero-day-exploited-in-north-korean-cyberattacks/"
        description = "Detects RelayShell PHP webshell used as C2 relay on compromised Roundcube/CMS servers"
    strings:
        $relay = "RelayShell" nocase
    condition:
        $relay and filesize < 100KB
}

title: Suspicious PDF Viewer Process with System Privileges
id: 7a3c1f2e-8b9d-4e6a-9c5f-1d2e3f4a5b6c
status: experimental
description: Detects PDF viewer processes running with System privileges, consistent with CVE-2026-68820 exploitation via afd.sys use-after-free
author: Adverse Trace
date: 2026/08/12
references:

    - https://www.securityweek.com/fresh-windows-zero-day-exploited-in-north-korean-cyberattacks/
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|contains:

            - 'pdf'
        IntegrityLevel:

            - 'System'
    filter_legitimate:
        Image|contains:

            - 'Acrobat'
            - 'Reader'
            - 'Foxit'
    condition: selection and not filter_legitimate
falsepositives:

    - Legitimate PDF software running as a service (rare)
level: high

title: DLL Sideloading via PDF Viewer Application
id: 8b4d2g3f-9c0e-5f7b-0d6a-2e3f4a5b6c7d
status: experimental
description: Detects unsigned or suspicious DLLs loaded by PDF viewer processes, consistent with Mistpen downloader delivery
author: Adverse Trace
date: 2026/08/12
references:

    - https://www.securityweek.com/fresh-windows-zero-day-exploited-in-north-korean-cyberattacks/
logsource:
    product: windows
    category: image_load
detection:
    selection_process:
        Image|contains:

            - 'pdf'
            - 'SecurityPDF'
    selection_dll:
        ImageLoaded|endswith:

            - '.dll'
    filter_signed:
        Signed: 'true'
        SignatureStatus: 'valid'
    condition: selection_process and selection_dll and not filter_signed
falsepositives:

    - Legitimate PDF plugins with expired certificates
level: high

Threat actor context

Lazarus Group · G0032 · aka Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. …

7. Sources

• SecurityWeek — Fresh Windows Zero-Day Exploited in North Korean Cyberattacks — https://www.securityweek.com/fresh-windows-zero-day-exploited-in-north-korean-cyberattacks/ — 2026-08-12
• Help Net Security — Lazarus hackers pair fake job offers with Windows zero-day exploit — https://www.helpnetsecurity.com/2026/08/12/north-korea-lazarus-fake-job-offers/ — 2026-08-12

8. Adverse Trace position

CVE-2026-68820 is a actively exploited Windows kernel zero-day (use-after-free in afd.sys) patched in the August 2026 Patch Tuesday cycle and listed in CISA KEV. The targeting is defense-sector focused (aerospace/aviation in France, Germany, India, Brazil), but the tradecraft — fake recruiter lures, trojanized PDF software, DLL sideloading — is directly transferable to financial services recruitment and headhunting workflows. EMEA clients should patch immediately, brief recruitment-facing staff, and hunt for the SecurityPDF trojanized viewer and RelayShell webshell on any internet-facing webmail or CMS infrastructure. The technical detail is single-sourced from Check Point; we will update this advisory as additional IOCs or corroboration emerge. Attribution to Lazarus Group (G0032) is consistent with known tradecraft but rests on a single vendor assessment.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.