North Korean state-sponsored hackers, identified as the **Lazarus Group**, have been actively exploiting a critical Windows zero-day vulnerability, **CVE-2026-68820**, as part of their 'Operation Dream Job' campaign. This sophisticated campaign primarily targets defense, aerospace, and aviation firms across Europe and India. ### Windows Zero-Day: A Gateway to System Privileges **Microsoft** recently addressed **CVE-2026-68820** in its latest Patch Tuesday updates, confirming it was actively exploited in the wild. The vulnerability is described as a "use-after-free in Windows Ancillary Function Driver for WinSock (**AFD.sys**)," which allows for local privilege escalation. Exploiting this flaw, a locally authenticated user can run a specially crafted application to trigger a race condition, subsequently gaining **SYSTEM** privileges without any user interaction. Researchers discovered that the **Lazarus Group** has been leveraging this exploit since early July. ### Operation Dream Job's Deceptive Lure The 'Operation Dream Job' campaign is characterized by its use of fraudulent recruitment offers. These offers are sent to employees within target entities, serving as the initial compromise vector. In a notable instance, the threat actor compromised an organization in France, subsequently using it as a launchpad for spear-phishing attacks against additional targets. ### FudModule Rootkit and Troy Backdoor Unleashed Cybersecurity firm **Check Point** has been tracking the latest variant of 'Operation Dream Job'. Their analysis revealed that the **Lazarus Group** integrated an exploit for **CVE-2026-68820** into a new version of their **FudModule** kernel-mode rootkit. This particular exploit supported **Windows 11** builds 26100 and 26200, enabling privilege escalation. .jpg) This isn't the first time the **Lazarus Group** has exploited an **AFD.sys** zero-day to install the **FudModule** rootkit. The latest iteration of the rootkit boasts previously documented capabilities, such as disabling **EDR** telemetry and interfering with security products, alongside new features like **Smart App Control** tampering. **Check Point** also uncovered a new backdoor named **Troy**, which supports 17 commands. These commands include system and process reconnaissance, file manipulation (upload, download, deletion, exfiltration), hidden command execution, remote process termination, in-memory **DLL** injection, and configuration changes. ### Compromising Roundcube Instances with RelayShell Beyond the Windows zero-day, **Check Point** also observed scans targeting vulnerable **Roundcube** installations. These instances were subsequently compromised with a new **PHP** web shell dubbed **RelayShell**. It is believed that the attackers used leaked credentials to authenticate to **Roundcube** before exploiting **CVE-2025-49113**, an authenticated **PHP** object-deserialization vulnerability, to achieve remote code execution.  At least 17 servers infected with **RelayShell** have been identified by researchers. "This new Operation Dream Job campaign focused heavily on the defense sector, particularly organizations involved in military technologies such as surveillance sensors, drones, and robotics," **Check Point** noted. The campaign's global reach extended into South America, including Brazil, with successful targeting observed in Western Europe, including France and Germany. These findings underscore the **Lazarus Group**'s continued evolution towards stealthier operations and their adaptability to targeted environments, often by abusing legitimate web infrastructure to mask malicious communications. **Check Point**'s report includes a list of indicators of compromise and a **YARA** rule to aid in detecting the **RelayShell** webshell.