A new wave of Operation Dream Job attacks has exposed a troubling truth for enterprise security teams: the social engineering playbook that North Korea’s Lazarus Group has refined over five years is now paired with a previously unknown Windows kernel exploit — and the combination is giving state-sponsored hackers SYSTEM-level access inside some of the world’s most sensitive organizations.
Check Point Research disclosed last week that Lazarus Group weaponized CVE-2026-68820, a privilege escalation vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys), as a zero-day before Microsoft patched it on August 11, 2026. Researchers believe attackers had a working exploit in hand as early as June, meaning defense and aerospace companies in France, Germany, Brazil, and India were at risk for at least five weeks with no available patch.
The Familiar Lure, The Unfamiliar Payload
Operation Dream Job has run since at least 2020, and its premise has changed very little: Lazarus operators impersonate recruiters on LinkedIn, dangle enticing roles at prestigious firms like Lockheed Martin and Enveil, and eventually convince victims to open a file or install a tool to “view the job description.” What has changed is the sophistication of what happens next.
In the latest campaign wave, researchers identified two parallel infection chains. The first relies on DLL side-loading: victims are directed to download an encrypted archive that triggers a chain of malicious code, eventually deploying a lightweight downloader called MISTPEN. MISTPEN communicates with attacker infrastructure using Microsoft Graph API and OneDrive — both legitimate cloud services — making network-level detection extremely difficult. Once MISTPEN is established, it loads the AFD.sys exploit, elevates privileges to SYSTEM, and deploys a remote-access tool called ForestTiger (also known as ScoringMathTea).
The second chain is more insidious. Lazarus registered at least three fake websites impersonating the real AI-security firm Enveil — using domains like envell[.]xyz and enveil[.]online — and distributed a trojanized PDF viewer called “SecurityPDF.” When a victim opens a specially marked PDF through this application, the viewer decrypts and launches a backdoor named Troy directly in memory. Troy supports 17 operator commands, enabling file enumeration, data exfiltration, interactive shell access, process termination, in-memory DLL injection, and configuration updates. The entire payload runs in memory, leaving minimal forensic trace on disk.
The Kernel-Level Rootkit: FudModule Gets an Upgrade
At the heart of the campaign is FudModule, a kernel-mode rootkit that Lazarus Group has deployed repeatedly since at least 2022. The newest iteration — FudModule 3.1 — represents a meaningful capability jump. Previous versions disabled logging and suppressed security software. Version 3.1 now also targets Windows Smart App Control, the feature introduced to verify whether programs are safe to run before execution.
The attack sequence runs as follows: after MISTPEN gathers host information and establishes a secure key exchange using the ML-KEM post-quantum key encapsulation algorithm, it decrypts and executes FudModule. FudModule exploits CVE-2026-68820 to gain SYSTEM privileges, then injects MISTPEN into a SYSTEM-level process. Running under SYSTEM context, FudModule sets the VerifiedAndReputablePolicyState to zero and invokes a system information call to trigger an in-place reload of the code integrity policy — effectively blinding Smart App Control to subsequent malicious activity.
The use of ML-KEM for key encapsulation is notable. It signals that Lazarus Group is already engineering its tools to resist future cryptanalysis, suggesting the group is playing a long game with infrastructure it expects to use for years.
Hiding in Plain Sight: Legitimate Infrastructure as C2
Rather than building bespoke command-and-control servers that defenders can enumerate and block, Lazarus Group has pivoted to hijacking legitimate but compromised websites. For this campaign, the group compromised WordPress sites, SharePoint installations, and vulnerable Roundcube webmail servers — exploiting CVE-2025-49113 in Roundcube to install a PHP web shell called RelayShell that exchanges commands via text files.
The result is C2 traffic that blends indistinguishably with normal enterprise web traffic. When a security team sees HTTP requests flowing to a reputable WordPress site or a SharePoint tenant, conventional threat intelligence filters are unlikely to flag them. In at least one case, a compromised French organization was used to relay phishing messages to new victims, borrowing the sender reputation of a real company to bypass email reputation filters.
Who Is at Risk
The campaign specifically targeted workers in defense, aerospace, and adjacent sectors — individuals whose professional identities on LinkedIn make them plausible recipients of outreach from defense contractors. The targeting geography (France, Germany, Brazil, India) reflects broader North Korean intelligence priorities, with European aerospace supply chains and Brazilian defense modernization projects particularly relevant to Pyongyang’s interests.
For enterprise security teams, the implications extend beyond those sectors. The tactics — trojanized software distributed through high-ranking search results, fake recruiter outreach, malware that hides behind legitimate cloud services — are increasingly applicable to any organization whose employees use LinkedIn for professional networking or download third-party tools outside of IT-managed software repositories.
What Organizations Should Do
Sergey Shykevich, director of threat intelligence at Check Point Software, offered a sobering framing: “When the website, the download, and the recruiter all appear authentic, the old advice to ‘spot the phishing link’ is no longer easily applicable.”
That assessment points toward several concrete defensive priorities. Patching AFD.sys via the August 2026 Patch Tuesday update is the immediate step — CVE-2026-68820 was fixed on August 11 and any unpatched Windows system remains vulnerable to the privilege escalation stage of the attack chain. Beyond patching, organizations should enforce application allowlisting so that only IT-approved PDF viewers and document tools can run, remove local administrator privileges from standard user accounts to raise the cost of privilege escalation, and implement network monitoring that flags unusual use of Microsoft Graph API and OneDrive from non-standard endpoints.
HR and recruiting workflows deserve scrutiny too. Employees in sensitive roles should receive specific training about the Dream Job pattern: any unsolicited recruiter outreach that ultimately requires installing software — no matter how convincing the job offer sounds — is a red flag that warrants verification through official company channels before any file is opened.
A Campaign That Keeps Evolving
What makes Operation Dream Job particularly dangerous over time is its adaptability. Lazarus Group has layered new tooling on top of a proven social engineering spine, and each iteration reveals a group that studies its own failures and patches them. FudModule grew from a privilege escalation tool to a Smart App Control bypass. The C2 infrastructure moved from dedicated servers to living off the land inside legitimate sites. The key exchange now uses post-quantum cryptography.
Microsoft has patched the vulnerability, and Smart App Control — once disabled by FudModule 3.1 — requires a Windows reinstall to re-enable. That detail alone underscores how deep the access these attackers achieved. For organizations in targeted sectors, the question is no longer whether nation-state adversaries will attempt to breach their systems. The question is how quickly they can detect that a breach is already underway.
Sources: Check Point Research, The Hacker News, Microsoft Security Response Center, SC Media, Security Affairs
