The notorious North Korean threat actor, **Lazarus Group**, has once again made headlines, attributed to the zero-day exploitation of a critical **Microsoft Windows** security flaw. This activity, identified by **Check Point Research**, is part of the long-running **Operation Dream Job** campaign, which leverages social engineering and sophisticated malware to infiltrate sensitive targets. ### Targeting Global Defense and Aerospace **Operation Dream Job** is a pervasive cyber espionage campaign orchestrated by Pyongyang-backed hackers. It primarily targets professionals in defense and aerospace sectors worldwide with highly convincing, yet fake, job offers from prominent firms like **Lockheed Martin** and **Enveil**. The attackers engage victims on platforms such as **LinkedIn**, impersonating recruiters to build trust and facilitate the delivery of malicious payloads. ### Zero-Day Exploitation: CVE-2026-68820 The latest wave of attacks exploited **CVE-2026-68820** (CVSS score: 7.0), a privilege escalation vulnerability impacting the Windows Ancillary Function Driver for WinSock (**AFD.sys**). **Microsoft** patched this flaw as part of its August 2026 Patch Tuesday updates. **Check Point Research** reported the vulnerability to Microsoft in late July 2026, noting that successful exploitation had been observed as early as June. ### New Backdoor: Troy Consistent with previous iterations of **Operation Dream Job**, victims are lured through bogus recruiter messages and tricked into opening malicious PDFs or installing trojanized PDF viewers. These actions lead to the installation of a new backdoor named **Troy**, which grants remote access to compromised machines. The ultimate goal is to seize complete control of infected systems and bypass existing security controls.  ### Dual Infection Chains The latest attacks feature two distinct parallel infection sequences: * **DLL Side-Loading**: Victims are instructed to download an encrypted archive that triggers a DLL side-loading chain. A malicious DLL (**libmupdf.dll**) displays a fake job description while stealthily downloading and executing **MISTPEN** in memory. **MISTPEN** communicates with threat actor-controlled infrastructure via **Microsoft Graph API** and **OneDrive** to retrieve reconnaissance and persistence modules. It then triggers the **AFD.sys** driver exploit before deploying **ForestTiger** (also known as **ScoringMathTea**), which provides remote access. * **Trojanized "SecurityPDF" PDF Viewer**: Victims are directed to download a fake "SecurityPDF" viewer from websites impersonating **Enveil**. Upon installation, the application monitors for specific markers within opened PDF documents. If detected, it decrypts and launches an embedded payload that loads the **Troy** backdoor directly into memory. The **Troy** DLL implant supports 17 operator commands for file enumeration, upload/download, archiving, exfiltration, interactive shell access, process termination, in-memory DLL injection, and configuration updates. ### Advanced Malware Capabilities **MISTPEN** loads several modules, including: * **GetInfoPlugin** (**Release_GetInfoPlugin_x64.dll**): Profiles the host and exfiltrates collected information. * **PvPlugin** (**Release_PvPlugin_x64.dll**): Gathers host reconnaissance data and details about running processes. * **OneScreenCapture** (**OneScreenCapture64.dll**): Takes and transmits screenshots of the desktop. * **LPE (local privilege escalation) loader**: Gathers host information, generates new key material using the **ML-KEM** post-quantum key encapsulation algorithm, and uses the negotiated key to decrypt and run **FudModule**. This attack chain utilizes an updated version of the kernel-mode rootkit that **Lazarus Group** has employed since at least 2022 to conceal malicious tools from security software. The newer version, **FudModule 3.1**, enhances its predecessor by tampering with **Windows Smart App Control**, a feature designed to verify program safety. By setting `VerifiedAndReputablePolicyState` to zero and invoking `NtSetSystemInformation` class 0xA4, the attackers trigger an in-place reload of the code integrity policy, allowing their malicious code to run undetected with SYSTEM privileges. ### Deceptive Infrastructure and C2 Operations The attackers created at least three websites impersonating **Enveil** (**envell[.]xyz**, **enveil[.]online**, **uxtramine[.]org**) to distribute the "SecurityPDF" viewer. Rather than building bespoke infrastructure, the campaign hijacks legitimate, but compromised, **WordPress** and **SharePoint** websites, as well as vulnerable **Roundcube** webmail servers, for use as **ForestTiger** command-and-control (C2) servers. This tactic makes it significantly harder to differentiate malicious traffic from normal web activity.  Many of the compromised **Roundcube** servers were vulnerable to **CVE-2025-49113**, which attackers exploited to install a previously undocumented PHP web shell named **RelayShell**. This shell facilitates the exchange of commands and responses via text files. In one instance, an already breached French organization was used to send phishing messages to new victims, bypassing reputation-based filters. The latest findings underscore the **Lazarus Group**'s continuous refinement of their malware capabilities and tradecraft, while maintaining the core principles of **Operation Dream Job** in their persistent attacks on critical global sectors.