Windows AFD.sys Zero-Day Exploited by Lazarus Hackers to Gain SYSTEM Access

Lazarus has expanded its long-running Operation Dream Job campaign by exploiting a Windows zero-day vulnerability that grants attackers SYSTEM-level access and helps neutralize endpoint visibility.

This DPRK-linked threat actor is specifically targeting defense, aerospace, and aviation organizations worldwide, with recent activity impacting entities in Europe and India.

Check Point Research identified the flaw as CVE-2026-68820, which is a local privilege escalation vulnerability in Microsoft’s Windows Ancillary Function Driver (AFD.sys).

Microsoft addressed this actively exploited issue in its August 2026 Patch Tuesday release following responsible disclosure.

Windows AFD.sys Zero-Day

Operation Dream Job relies on fraudulent recruiting tactics designed to attract professionals in high-value industries.

Attackers impersonate recruiters or trusted companies, delivering encrypted ZIP archives that contain either a legitimate signed PDF reader alongside a malicious DLL, or a trojanized PDF application called SecurityPDF.

In the first infection chain, Lazarus abuses DLL sideloading. A legitimate PDF-viewer executable loads a malicious library (libmupdf.dll), which displays a decoy job description PDF while decrypting and executing malware directly in memory.

The initial payload, known as MISTPEN, is an in-memory downloader that communicates through attacker-controlled Microsoft OneDrive content using the Graph API.

A newer chain employs SecurityPDF, a modified MuPDF-based viewer distributed through websites that impersonate the privacy technology firm Enveil.

When a victim opens a specially crafted PDF, SecurityPDF checks for a specific embedded marker, decrypts a payload using a single-byte XOR key, writes it as new.exe in the user’s temporary directory, and launches it. This executable reflectively loads a newly identified backdoor called Troy.

The campaign’s use of impersonation domains and search engine optimization provides an additional layer of credibility.

Instead of delivering all malicious components in a single phishing message, operators direct targets to seemingly legitimate download sites, reducing the likelihood that email-based security controls will identify the full attack chain.

AFD.sys Flaw Enables Rootkit Deployment

Once a foothold is established, MISTPEN deploys reconnaissance modules to gather system, account, process, and screenshot data. It then delivers an in-memory local privilege escalation module that exploits CVE-2026-68820.

This vulnerability affects how AFD.sys handles socket states under concurrent access. By triggering a race condition, Lazarus can cause a use-after-free condition to obtain kernel read/write privileges. This allows escalation from a compromised user context to SYSTEM privileges.

The exploit deploys a new variant of the FudModule, Lazarus’s kernel-mode rootkit. FudModule is designed to degrade security telemetry by removing or interfering with callbacks, filters, event-tracing components, and monitoring in security products.

The new variant reportedly adds tampering capabilities against Smart App Control and focuses on newer Windows 11 builds, including builds 26100 and 26200.

With SYSTEM access, the attackers inject another instance of MISTPEN into a privileged process, allowing their operations to continue with reduced visibility into endpoint detection and response (EDR).

The campaign thereafter deploys ForestTiger for persistent remote access or Troy, a modular remote access trojan that supports reconnaissance, file transfer, command execution, process management, and reflective DLL injection.

Lazarus has also compromised Roundcube and WordPress infrastructure for command-and-control (C2) relays. Researchers have linked this activity to the exploitation of CVE-2025-49113 in vulnerable Roundcube deployments, where compromised credentials may have enabled authenticated exploitation.

The attackers deploy RelayShell, a PHP web shell that primarily serves as a relay rather than a conventional interactive shell.

It establishes sessions between the victim and the operator and stores the exchanged messages in temporary files on compromised servers. This approach blends C2 traffic into legitimate web infrastructure, making attribution or network blocking more difficult.

Defenders are advised to immediately apply Microsoft’s August security updates, hunt for the listed hashes and domains, restrict unauthorized installations of PDF readers, and investigate unusual OneDrive Graph API activity, DLL sideloading behavior, and SYSTEM-level execution of msiexec.exe.

Indicators of Compromise

Category	Indicators
CVEs	CVE-2026-68820; CVE-2025-49113
Malicious websites	envell[.]xyz; enveil[.]online; uxtramine[.]org
Troy C2 IPs	135.181.67[.]203; 135.181.185[.]158
SecurityPDF.exe SHA-256	743172aab606974b054a64561534ae66baa3a840657f79d7c6fa18350e8d45d1; db3d69b7eeda2e35e23006bf4b7e206281fce809584207214fc213f9bc30376d
FudModule SHA-256	3b6378df8442e63a6ed7317075913e4720847a510d95022d4a8347b2637c245d
Troy SHA-256	590fb6ae19480d694e08ee85859cad8066f2f87e7e5abba2960c6d115e1615d6; 68d4fba7b1300a59cd6212c08910a260cd71b40cd9f51cac933030a68faac0bb; a738059ce07c951c31ab2da3d93d8f69bff32f9b7d933dbf5943441b9cc99075
RelayShell SHA-256	21c3ad4838c4324bc5f081021da5fb2e9073d0c9304087811c21eb47c9e22762; cc4e06aa378a190f71384c03023bb3d18a6d66e297d46701220e132963d2e222
ForestTiger SHA-256	72dccae85e062f541fecad9ec7a18a3123e7ae5ac5d53c91709b53a46dbbd289; 231b1ef8b95bf77887d5377e2a60f649035e78f543af1b82877db36a5759d858

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world