Lazarus Group Exploits Windows Zero-Day to Deploy Troy Backdoor
The North Korean state-sponsored threat actor Lazarus Group has been linked to a sophisticated cyber-espionage campaign exploiting a previously unknown Windows vulnerability to infiltrate defense and aerospace firms in France, Germany, Brazil, and India. Tracked as part of the long-running Operation Dream Job, the campaign leverages fraudulent recruiter personas on LinkedIn—impersonating firms such as Lockheed Martin and Enveil—to lure victims into opening malicious PDFs or installing trojanized software. Once inside, attackers deploy a novel backdoor dubbed Troy to gain full remote control of compromised systems and exfiltrate sensitive defense industry data.
The attack chain hinges on CVE-2026-68820 (CVSS 7.0), a privilege escalation flaw in the Windows Ancillary Function Driver for WinSock (AFD.sys), patched by Microsoft in its August 2026 Patch Tuesday rollout. Check Point Research observed two parallel infection sequences. The first relies on DLL side-loading through a malicious library (libmupdf.dll) embedded in an encrypted archive, which silently fetches a lightweight in-memory downloader called MISTPEN. MISTPEN communicates with attacker-controlled infrastructure via Microsoft Graph API and OneDrive to stage reconnaissance modules, trigger the AFD.sys exploit, and ultimately deploy ForestTiger (also tracked as ScoringMathTea) for persistent remote access. Security teams investigating suspicious OneDrive activity can validate outbound connections using a DNS leak test to detect anomalous resolver behavior.
The second vector uses a trojanized PDF viewer branded as SecurityPDF, distributed from a website spoofing Enveil. The application scans every opened PDF for a hardcoded marker string ("This document is encrypted with sumatrapdf reader!!!!!!!!!!!!"), and when matched, decrypts and executes an embedded payload that loads Troy directly into memory. The Troy implant supports 17 operator commands, including file enumeration, upload/download, archive exfiltration, interactive shell access, process termination, in-memory DLL injection, and runtime configuration updates—giving operators near-total control over the infected host. The reuse of trojanized PDF viewers echoes Lazarus tradecraft dating back to 2022, when similar lures were used against aerospace and defense contractors.
Operation Dream Job underscores how North Korea continues to combine zero-day exploits with tailored social engineering to penetrate high-value targets. Organizations in the defense supply chain should prioritize patching AFD.sys immediately, audit LinkedIn-sourced recruiting communications, and review endpoint telemetry for AFD.sys driver abuse. Professionals in targeted sectors should also verify whether their credentials have appeared in known leaks using an email breach checker and strengthen authentication hygiene with a password checker to prevent reuse of compromised credentials across work and personal accounts.