Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack

1. Executive summary

Check Point Research has published analysis of an ongoing Operation Dream Job campaign active since early 2026, primarily targeting the global defense, aerospace, and aviation sectors, with confirmed compromises in Western Europe (France, Germany). The threat actor distributes trojanized PDF viewers via SEO-poisoned impersonation websites to deliver the MISTPEN downloader and the newly identified Troy backdoor. The campaign deploys a new variant of the FudModule rootkit, exploiting CVE-2026-68820 (CVSS 7.0 HIGH, CWE-416 Use After Free), a zero-day local privilege escalation (LPE) vulnerability in the Windows AFD.sys driver, patched by Microsoft on August 11, 2026. CVE-2026-68820 is NOT currently listed in CISA KEV. Attribution to Operation Dream Job / Lazarus is unconfirmed (no MITRE ATT&CK profile available in verified reference data). EMEA financial services clients with defense-sector subsidiaries or supply-chain links should treat this as a high-impact targeted threat.

2. Regulatory framing

No specific NIS2 or UK NIS article is directly engaged beyond generic incident-reporting obligations, as the verified reference data does not supply a distinctive supply-chain or cross-border-coordination trigger unique to this item.

3. Technical analysis & attack chain

Attribution caveat: The source attributes this activity to "Operation Dream Job" / Lazarus (referred to as "ForestTiger" for C2 infrastructure). The verified reference data contains no MITRE ATT&CK profile for "Operation Dream Job." Attribution is therefore treated as unconfirmed. All technical details below are single-sourced from Check Point Research; verify before enforcement.

Attack chain

1. Initial contact: Threat actor poses as a recruiter on professional networking platforms (likely LinkedIn) or messaging apps, offering fraudulent defence-sector job opportunities. In July 2026, lures impersonated Enveil, a legitimate Privacy Enhancing Technology company. Enveil itself was not compromised.
2. Delivery via impersonation websites: At least three SEO-optimised websites impersonating Enveil distribute a trojanized PDF viewer. These sites rank highly in search results. The actor likely separates delivery of the crafted PDF (via phishing) from delivery of the viewer (via impersonation site) to evade detection.
3. Infection Chain 1 (earlier): Victim downloads an encrypted ZIP containing three files (details partially truncated in source). Launching the executable triggers DLL sideloading via libmupdf.dll. The DLL displays a decoy PDF while extracting, decrypting, and executing an embedded payload in memory.
4. Infection Chain 2 (July 2026 onward): Victim downloads an encrypted ZIP containing SecurityPDF.exe (a trojanized MuPDF-based viewer) and a crafted PDF. When any PDF is opened via File → Open or drag-and-drop, the viewer checks for the marker string This document is encrypted with sumatrapdf reader!!!!!!!!!!!!. If present, it extracts the embedded payload, decrypts it with a single-byte XOR key (0x39), writes the result to %TEMP%\new.exe, and launches it as a child process.
5. new.exe execution: Reflectively loads an embedded DLL containing the Troy backdoor (first observed in this campaign).
6. MISTPEN deployment (Chain 1): The in-memory payload is MISTPEN, a lightweight downloader first documented by Mandiant in 2024. It uses the Microsoft Graph API to communicate via attacker-controlled files hosted on OneDrive. All files are AES-encrypted with separate keys for uploads and downloads. MISTPEN reflectively loads PE DLLs into memory.
7. MISTPEN modules: MISTPEN deploys in-memory modules that lack their own network communication and return data to MISTPEN for exfiltration: - GetInfoPlugin (Release_GetInfoPlugin_x64.dll): Collects domain/workgroup (via NetGetJoinInformation), computer name, username, OS version/build. Output template: Domain: <domain> ComputerName: <hostname> UserName: <username> OsInfo: <Windows product name> <build_number>.<UBR> - PvPlugin (Release_PvPlugin_x64.dll): Extended GetInfoPlugin adding process enumeration (PID, PPID, creation timestamp, domain, user, process name). - OneScreenCapture (OneScreenCapture64.dll): Captures virtual desktop via USER32/GDI APIs, converts to JPEG, Base64-encodes, returns to MISTPEN. - LPE Loader module: 64-bit DLL loaded by an extended MISTPEN variant providing an RPC buffer for inter-component communication. Data is encrypted with GOST-CBC using a random 16-byte session key, Base64-encoded, with the session key prepended to each packet. The module operates in four stages (full details not disclosed by source).
8. Privilege escalation via FudModule: The LPE loader downloads FudModule (Afd4Eop12_x64.dll, compiler timestamp July 7, 2026 22:07:44 UTC), a Lazarus kernel-mode exploit module active since ~2021. This variant exploits CVE-2026-68820 (CVSS 7.0 HIGH, CWE-416 Use After Free) in the Windows Ancillary Function Driver (afd.sys).

Vulnerability mechanism: The exploit triggers a race condition in afd.sys when a socket is created and accessed concurrently by multiple threads. Two code paths operate on socket state simultaneously without synchronisation. If timed correctly, one path accesses memory after another has freed it (use-after-free), yielding a kernel read/write primitive used for LPE to SYSTEM.

Targeting: Explicit minimum-version check for Windows 11 build 26100 (24H2), with support for build 26200 (25H2). Does not target older builds.

Post-exploitation: Injects a payload (another MISTPEN instance) into a SYSTEM process. Shared with FudModule v3: injection into services.exe → SYSTEM msiexec.exe process. Debug strings: GetGodMode failed, GetSystemHandle passed, CreateRemoteProcess passed, RemoteDllExecute passed, ClearVaccine* family. Removed from v3: dedicated MsMpEng.exe targeting (orphaned string SuspendDefender passed remains). New since v3: remote stub in msiexec.exe child sets VerifiedAndReputablePolicyState to zero and invokes NtSetSystemInformation class 0xA4 with option 0x10000000, triggering in-place reload of code integrity policy — blinding Defender and other security products via generic suppression.

Discrepancy note: The source compares CVE-2026-68820 to CVE-2025-60719 (another use-after-free in AFD.sys fixed November 2025) and CVE-2024-38193 (used by FudModule in 2024). Testing confirmed CVE-2026-68820 is a distinct vulnerability. The verified reference data classifies CVE-2026-68820 as CWE-416 (Use After Free), consistent with the source description.

9. Troy backdoor: 64-bit DLL, 17 operator commands. PDB path: E:\HK\Tool_Module\Troy_Handle\1Troy_Create_Dll_Tool\x64\Release\Test_Dll.pdb. Supports three C2 servers (URL + port each). Iterates servers at startup, validates response against string CONNECTED. Challenge-response handshake for authentication. Registration sends client ID + system profile (user profile directory, account name, Windows version, local IPv4, working directory). Commands are Base64-encoded; results returned in JSON envelope { "to":"<channel>", "msg":"<base64>" }. Port hardcoded to 80.

Troy commands: WAIT (keepalive), DRIVES (volume enumeration), LIST|<path> (directory listing), OPEN|<exe> [args] (hidden process creation), DELETE|<path> (file/folder deletion), ZIPDOWNLOAD|<src>|<dst> (PowerShell Compress-Archive exfiltration), DOWNLOAD|<src>|<dst> (chunked file exfil), UPLOAD|<src>|<dst> (file drop), CMD|<commandline> (interactive shell with cd /d tracking, 10s watchdog), mem <dllpath> <pid> (reflective DLL injection), pk <pid> (process termination), sleep <N> (one-shot delay), DEFAULTSLEEP (configured beacon interval), GET_CONFIG (returns 8 fields: client ID, sleep interval, 3 server/port pairs), SET_CONFIG| (writes 8 fields; only idle interval takes effect at runtime), pvd (process listing with command lines via WMI), pv (process listing without command lines).

10. C2 infrastructure — RelayShell: Compromised Roundcube webmail servers (mostly running versions vulnerable to CVE-2025-49113, a PHP object deserialization RCE) and WordPress/PrestaShop servers host RelayShell, a novel PHP webshell. Actor likely used dark-web credential leaks to authenticate to Roundcube instances before exploiting CVE-2025-49113.RelayShell operation: Two modes selected by HTTP POST password:
    • Victim mode: Creates PHP session, decrypts hidden config (custom substitution cipher) containing a unique identifier and authentication password, sends HTTP POST to a backbone URL (another RelayShell instance) signalling new victim session.
    • Operator mode: Commands for session management, connectivity checks, file upload/delete, log retrieval, self-delete.
    • Communication: File-based channel using <session_id><object>.log naming convention (1 = victim, 2 = operator). send writes to sender's file; receive reads opposite side's file.
    • 17 unique identifiers observed (≥17 compromised relay servers). Actor accessed RelayShell via shared VPN services including ExpressVPN.

4. Mitigation & containment

P1 — Within 24 hours

• Patch CVE-2026-68820: Apply Microsoft August 11, 2026 Patch Tuesday updates to all Windows 11 24H2 (build 26100) and 25H2 (build 26200) systems immediately. This is the only vendor fix available.
• Block known C2 domains and IPs at firewall/proxy/DNS sinkhole: envell[.]xyz, enveil[.]online, uxtramine[.]org, 135.181.67[.]203, 135.181.185[.]158.
• Block Microsoft Graph API / OneDrive traffic from non-managed endpoints or endpoints that should not access consumer OneDrive; MISTPEN abuses Graph API for C2. If blanket blocking is infeasible, deploy DLP/CASB rules flagging anomalous OneDrive file access patterns from endpoint processes.
• Quarantine all hashes listed in §5 via EDR.

P2 — Within 72 hours

• Hunt for FudModule indicators: Search EDR telemetry for processes spawning msiexec.exe as a child of services.exe with no legitimate MSI installation context. Alert on NtSetSystemInformation calls with class 0xA4 / option 0x10000000. Search for the string enable_god_mode passed and SuspendDefender passed in process memory.
• Hunt for Troy backdoor: Alert on HTTP connections validating response against plaintext CONNECTED. Monitor for JSON envelopes matching { "to":"<channel>", "msg":"<base64>" } in outbound traffic. Alert on processes with PDB path containing Troy_Handle.
• Hunt for RelayShell: Scan external-facing web servers (Roundcube, WordPress, PrestaShop) for .ses files and .log files matching <session_id>1.log / <session_id>2.log patterns. Audit Roundcube instances for CVE-2025-49113 exposure and patch. Check for leaked credentials in dark-web feeds.
• Hunt for SecurityPDF: Search endpoint file systems for SecurityPDF.exe and %TEMP%\new.exe. Alert on PDF files containing the marker This document is encrypted with sumatrapdf reader!!!!!!!!!!!!.
• Block DLL sideloading: Enforce SafeDllSearchMode and apply application directory DLL allowlisting to prevent libmupdf.dll sideloading.

P3 — Within 7 days

• Conduct retrospective spear-phishing review: Search mail logs for recruiter-themed lures referencing defence/aerospace jobs, Enveil impersonation, or links to the three impersonation domains. Check LinkedIn/message-app logs for suspicious recruiter contact patterns.
• Audit ExpressVPN exit-node traffic against external-facing infrastructure if inbound connections from shared VPN services are logged.
• Verify EDR tamper-protection: Confirm EDR agents resist kernel-mode code integrity policy manipulation (the VerifiedAndReputablePolicyState zeroing technique). Engage vendor support if tamper-protection bypass is confirmed.
• Brief HR and recruitment-facing staff on the impersonation tactic; flag unsolicited job-offer lures targeting defence/aerospace sectors.

5. Indicators of compromise

sha256  2b4987c07a3d9a9a5d1a9bf4efa3d1903e775090b611710edafdc92874265ca8
sha256  3a02d0d798e8d35555776886d92b20ff38a101c9ef7e0eebc8ce5d259516525a
sha256  92106b0c62a0a42678232f8273f030b2d3c8e92efce81b98b9eec70cfe98afa1
sha256  396192d92d17ace1a521f1351eeeba2825e60badd0d799cc5c338e4934b3c82c
sha256  f7e620134ca935067797ab957317b346ce0df84a4e9b9ca54a6acc9b75afda4d
sha256  75b93a7103b0562f6497d30052c0c5cf7aa58c1bf0e9297022b74469a7f096f1
sha256  a45144d22cac70a45d71cf4dffa4efbc373658779a56cf1300d6ac863d6cc7e2
sha256  1de949c71efcfb0ffc41f33d38833dbc4b082075b1a540fc68c18c535d7ad86c
sha256  4c9b804d6155b29f1e27a9ffe531e10bc42a7bdab42f905b50146bf2026768d9
sha256  29e24c007549e51319ff3aee011da6f9f93568e8c85a5ad69c9e53bd3f4533a2
sha256  4ebdce2f47c23ff8c9e8e80c8b5239c7a5764da31cd3ab8f0505926890adc105
sha256  c2aa28bb5e2a749c693712008276f311edd912f689371ef9e8a1ee5fb4167461
sha256  2db25ac41a66aa523c79e23e00443573530dd7bd82b8371bcc87bd7232e141eb
sha256  5278ee922838352f1480a73e971161017d643a80b7ec22bf725897dfd088696d
sha256  b4082d21070d9ddf53fde4ea22524d09e41ec9826ce63cef3c6235e458d21afb
sha256  fb3fc5626f68677fb1269a2fefbe70e719211b4065e836ab92e06a8210139a2d
sha256  ea7056f2bf36c66a61ff787ff5be975a85f534c3c5ca178791dac2504db2c619
sha256  13d10bc99f7f7abe7ee0902be87920b73b2ea41bd9683dbfcad340dacbcdef79
sha256  4fd32432341dfcf54d0517a6bbc38e5d265be70933493e4183c2a340cdde9a2d
sha256  4dd792c9f672bbdcc8d363d745994efe90f4ffc5fdc2c059c8e379a48ad6a68a
sha256  ba96c603e44046de703c67b2c3b7e4ca974afef7b437a0244418bc4edc781bb7
sha256  72dccae85e062f541fecad9ec7a18a3123e7ae5ac5d53c91709b53a46dbbd289
sha256  231b1ef8b95bf77887d5377e2a60f649035e78f543af1b82877db36a5759d858
sha256  6da9b1e6f3315ceb77dd14a937a26cc3602bf6a7e2c2ecafb3c65ce5319837be
sha256  a0578a2b7821d7e2c573530648f26d7a0d98b373ab24fb7f0c792736761e542d
sha256  82268052f94df6f4870d02e57b18d4c54136cc7a8c8d80ad162631f99462c943
sha256  3b6378df8442e63a6ed7317075913e4720847a510d95022d4a8347b2637c245d
sha256  a673ae661593c0de9bbb815593b816a6853dad6d55ad5042d2ef1875cd13d6e7
sha256  8ce6c29f92dc45b1474417cbdff4ed0c18e58fa63e3a071ee9f85aa9d2aac07c
sha256  acb97cec84e08b89f41967a24e965d1fd2c51751cef158f7aa35bb4306b87b97
sha256  3601060c62edeeaa49def6a13be6e126e1024ce011faad4e2d9f585ccf6bd5a6
sha256  fecf12088843801215898442bd1ff3e266f29d14e29a94780e857f69c4915d6b
sha256  d578c28c9afe7457a0d81f6701332ef8197e8f7468de654935fb29a50ea66459
sha256  743172aab606974b054a64561534ae66baa3a840657f79d7c6fa18350e8d45d1
sha256  db3d69b7eeda2e35e23006bf4b7e206281fce809584207214fc213f9bc30376d
sha256  590fb6ae19480d694e08ee85859cad8066f2f87e7e5abba2960c6d115e1615d6
sha256  68d4fba7b1300a59cd6212c08910a260cd71b40cd9f51cac933030a68faac0bb
sha256  a738059ce07c951c31ab2da3d93d8f69bff32f9b7d933dbf5943441b9cc99075
sha256  21c3ad4838c4324bc5f081021da5fb2e9073d0c9304087811c21eb47c9e22762
sha256  cc4e06aa378a190f71384c03023bb3d18a6d66e297d46701220e132963d2e222
domain  envell[.]xyz
domain  enveil[.]online
domain  uxtramine[.]org
ipv4  135.181.67[.]203
ipv4  135.181.185[.]158

6. Detection

rule lazarus_relayshell {
  meta:
    author = "Adverse Trace"
    date = "2026-08-11"
    reference = "https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/"
    description = "Detects Lazarus RelayShell PHP webshell"
  strings:
    $str1 = "'PqCWom'"
    $str2 = "'a84038'"
    $str3 = "'biwbih'"
    $str4 = "'ddf7acea'"
    $str5 = "'enRU904U'"
    $str6 = "'fou2rm'"
    $str7 = "'kurhiW'"
    $str8 = "'qcrgl'"
    $str9 = "'rlzbiw'"
    $str10 = "'tmmvr1'"
    $str11 = "'win386'"
    $str12 = "\"biwbih\""
    $str13 = "\"PqCWom\""
    $str14 = "\"a84038\""
    $str15 = "\"ddf7acea\""
    $str16 = "\"enRU904U\""
    $str17 = "\"fou2rm\""
    $str18 = "\"kurhiW\""
    $str19 = "\"qcrgl\""
    $str20 = "\"rlzbiw\""
    $str21 = "\"tmmvr1\""
    $str22 = "\"win386\""
    $str23 = "D9hWnVEqdgzJ67/B8euS0yKCIMrw5jc:fGUX3AakLH2oYQRp"
  condition:
    3 of ($str*)
}

rule lazarus_fudmodule_variant {
  meta:
    author = "Adverse Trace"
    date = "2026-08-11"
    reference = "https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/"
    description = "Detects FudModule kernel-mode LPE exploit variant targeting afd.sys"
  strings:
    $s1 = "enable_god_mode passed." fullword ascii
    $s2 = "GetGodMode failed" fullword ascii
    $s3 = "GetSystemHandle passed." fullword ascii
    $s4 = "CreateRemoteProcess passed." fullword ascii
    $s5 = "RemoteDllExecute passed." fullword ascii
    $s6 = "SuspendDefender passed" fullword ascii
    $s7 = "VerifiedAndReputablePolicyState" wide ascii
    $pdb = "Troy_Handle" ascii
  condition:
    3 of ($s*) or $pdb
}

rule lazarus_troy_backdoor {
  meta:
    author = "Adverse Trace"
    date = "2026-08-11"
    reference = "https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/"
    description = "Detects Troy modular backdoor DLL"
  strings:
    $pdb = "E:\\HK\\Tool_Module\\Troy_Handle\\1Troy_Create_Dll_Tool\\x64\\Release\\Test_Dll.pdb" ascii
    $cmd1 = "ZIPDOWNLOAD|" ascii
    $cmd2 = "DEFAULTSLEEP" ascii
    $cmd3 = "GET_CONFIG" ascii
    $cmd4 = "SET_CONFIG|" ascii
    $json = "{ \"to\":\"" ascii
    $connected = "CONNECTED" ascii
  condition:
    $pdb or (3 of ($cmd*) and $json and $connected)
}

rule lazarus_mistpen_modules {
  meta:
    author = "Adverse Trace"
    date = "2026-08-11"
    reference = "https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/"
    description = "Detects MISTPEN in-memory plugin DLLs"
  strings:
    $mod1 = "Release_GetInfoPlugin_x64.dll" ascii
    $mod2 = "Release_PvPlugin_x64.dll" ascii
    $mod3 = "OneScreenCapture64.dll" ascii
    $fmt = "Domain: " ascii
  condition:
    1 of ($mod*) or $fmt
}

rule lazarus_securitypdf_marker {
  meta:
    author = "Adverse Trace"
    date = "2026-08-11"
    reference = "https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/"
    description = "Detects trojanized SecurityPDF embedded marker in crafted PDF payloads"
  strings:
    $marker = "This document is encrypted with sumatrapdf reader!!!!!!!!!!!!" ascii
  condition:
    $marker
}

title: Lazarus Operation Dream Job - Troy Backdoor C2 Beacon
id: 7c3f1a2e-5b8d-4e6f-9a1c-0d2e3f4a5b6c
status: experimental
description: Detects Troy backdoor C2 connection validating response against CONNECTED string
author: Adverse Trace
date: 2026/08/11
references:

  - https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/
logsource:
  product: windows
  category: network_connection
detection:
  selection:
    Initiated: 'true'
    DestinationPort: 80
  filter_legitimate:
    Image|endswith:

      - '\svchost.exe'
      - '\wuauserv.exe'
  condition: selection and not filter_legitimate
  # Note: Correlate with EDR memory scan for CONNECTED string in process memory
falsepositives:

  - Legitimate HTTP traffic on port 80 (rare in managed environments)
level: high

---
title: Lazarus FudModule - NtSetSystemInformation Code Integrity Policy Reload
id: 8d4f2b3c-6c9e-4f7a-0b2d-1e3f4a5b6c7d
status: experimental
description: Detects FudModule variant disabling security products via NtSetSystemInformation class 0xA4
author: Adverse Trace
date: 2026/08/11
references:

  - https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/
logsource:
  product: windows
  category: process_access
detection:
  selection_msiexec:
    TargetImage|endswith: '\msiexec.exe'
    SourceImage|endswith: '\services.exe'
  condition: selection_msiexec
  # Note: Correlate with EDR ETW for NtSetSystemInformation syscall class 0xA4
falsepositives:

  - Legitimate MSI installation via services.exe (rare; verify MSI context)
level: critical

---
title: Lazarus SecurityPDF Trojanized Viewer Execution
id: 9e5f3c4d-7d0f-4a8b-1c3e-2f4a5b6c7d8e
status: experimental
description: Detects SecurityPDF.exe writing and launching new.exe from TEMP
author: Adverse Trace
date: 2026/08/11
references:

  - https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/
logsource:
  product: windows
  category: process_creation
detection:
  selection_child:
    ParentImage|endswith: '\SecurityPDF.exe'
    Image|endswith: '\new.exe'
  selection_temp:
    Image|startswith: 'C:\Users\'
    Image|contains: '\AppData\Local\Temp\new.exe'
  condition: selection_child or selection_temp
falsepositives:

  - Unknown
level: critical

CVE assessment

1 referenced CVE

7. Sources

• Check Point Research, "Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack," https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/, published 2026-08-11.

8. Adverse Trace position

CVE-2026-68820 (CVSS 7.0 HIGH, CWE-416) is a confirmed zero-day in the Windows AFD.sys kernel driver, actively exploited in the wild since at least early July 2026 as part of Operation Dream Job. Microsoft patched it on August 11, 2026; it is NOT in CISA KEV. The campaign demonstrates a mature, multi-stage kill chain combining SEO-poisoned impersonation sites, trojanized PDF viewers, in-memory modular malware (MISTPEN), a new backdoor (Troy), a kernel-mode EDR-disabling rootkit (FudModule), and a novel relay-based C2 architecture (RelayShell) abusing compromised Roundcube/WordPress/PrestaShop servers. Attribution to Operation Dream Job / Lazarus is unconfirmed per verified reference data (no MITRE ATT&CK profile). All technical detail is single-sourced from Check Point Research; clients should verify IOCs before enforcement. EMEA financial services clients with defence-sector subsidiaries, aerospace supply-chain relationships, or operations in France/Germany/India/Brazil should prioritise the August 11 Microsoft patch on Windows 11 24H2/25H2 systems, block the listed C2 infrastructure, and hunt for the described behaviours. We will update this advisory if CISA adds CVE-2026-68820 to KEV or if corroborating sources confirm attribution.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.