Windows AFD.sys Zero-Day Exploited by Lazarus Hackers to Gain SYSTEM Access

Lazarus has expanded its long-running Operation Dream Job campaign by exploiting a Windows zero-day vulnerability that grants attackers SYSTEM-level access and helps neutralize endpoint visibility.

This DPRK-linked threat actor is specifically targeting defense, aerospace, and aviation organizations worldwide, with recent activity impacting entities in Europe and India.

Check Point Research identified the flaw as CVE-2026-68820, which is a local privilege escalation vulnerability in Microsoft’s Windows Ancillary Function Driver (AFD.sys).

Microsoft addressed this actively exploited issue in its August 2026 Patch Tuesday release following responsible disclosure.

Windows AFD.sys Zero-Day

Operation Dream Job relies on fraudulent recruiting tactics designed to attract professionals in high-value industries.

Attackers impersonate recruiters or trusted companies, delivering encrypted ZIP archives that contain either a legitimate signed PDF reader alongside a malicious DLL, or a trojanized PDF application called SecurityPDF.

In the first infection chain, Lazarus abuses DLL sideloading. A legitimate PDF-viewer executable loads a malicious library (libmupdf.dll), which displays a decoy job description PDF while decrypting and executing malware directly in memory.

The initial payload, known as MISTPEN, is an in-memory downloader that communicates through attacker-controlled Microsoft OneDrive content using the Graph API.

A newer chain employs SecurityPDF, a modified MuPDF-based viewer distributed through websites that impersonate the privacy technology firm Enveil.

When a victim opens a specially crafted PDF, SecurityPDF checks for a specific embedded marker, decrypts a payload using a single-byte XOR key, writes it as new.exe in the user’s temporary directory, and launches it. This executable reflectively loads a newly identified backdoor called Troy.

The campaign’s use of impersonation domains and search engine optimization provides an additional layer of credibility.

Instead of delivering all malicious components in a single phishing message, operators direct targets to seemingly legitimate download sites, reducing the likelihood that email-based security controls will identify the full attack chain.

AFD.sys Flaw Enables Rootkit Deployment

Once a foothold is established, MISTPEN deploys reconnaissance modules to gather system, account, process, and screenshot data. It then delivers an in-memory local privilege escalation module that exploits CVE-2026-68820.

This vulnerability affects how AFD.sys handles socket states under concurrent access. By triggering a race condition, Lazarus can cause a use-after-free condition to obtain kernel read/write privileges. This allows escalation from a compromised user context to SYSTEM privileges.

The exploit deploys a new variant of the FudModule, Lazarus’s kernel-mode rootkit. FudModule is designed to degrade security telemetry by removing or interfering with callbacks, filters, event-tracing components, and monitoring in security products.

The new variant reportedly adds tampering capabilities against Smart App Control and focuses on newer Windows 11 builds, including builds 26100 and 26200.

With SYSTEM access, the attackers inject another instance of MISTPEN into a privileged process, allowing their operations to continue with reduced visibility into endpoint detection and response (EDR).

The campaign thereafter deploys ForestTiger for persistent remote access or Troy, a modular remote access trojan that supports reconnaissance, file transfer, command execution, process management, and reflective DLL injection.

Lazarus has also compromised Roundcube and WordPress infrastructure for command-and-control (C2) relays. Researchers have linked this activity to the exploitation of CVE-2025-49113 in vulnerable Roundcube deployments, where compromised credentials may have enabled authenticated exploitation.

The attackers deploy RelayShell, a PHP web shell that primarily serves as a relay rather than a conventional interactive shell.

It establishes sessions between the victim and the operator and stores the exchanged messages in temporary files on compromised servers. This approach blends C2 traffic into legitimate web infrastructure, making attribution or network blocking more difficult.

Defenders are advised to immediately apply Microsoft’s August security updates, hunt for the listed hashes and domains, restrict unauthorized installations of PDF readers, and investigate unusual OneDrive Graph API activity, DLL sideloading behavior, and SYSTEM-level execution of msiexec.exe.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world