Lazarus Uses AFD.sys Zero-Day in Operation Dream Job Campaign Targeting Defense Sector
Summary
Check Point researchers detail a Lazarus campaign using job lures, trojanized PDF viewers, and compromised web servers to target defense organizations. The operation exploited Windows AFD.sys CVE-2026-68820, which Microsoft patched on August 11, 2026.
Key points
- Operation Dream Job targeted defense, aerospace, and aviation organizations worldwide, with activity in Europe, India, and Brazil.
- The attackers used spear-phishing job offers and impersonation websites to distribute malicious PDF viewers and payloads.
- The campaign deployed MISTPEN, ForestTiger, a new Troy backdoor, and the FudModule kernel rootkit.
- FudModule exploited the Windows AFD.sys zero-day CVE-2026-68820 to gain SYSTEM privileges and suppress security monitoring; Microsoft patched it on August 11, 2026.
- Lazarus exploited vulnerable Roundcube servers and compromised other web servers to install RelayShell, using them as command-and-control relays.
- A compromised organization in Western Europe was used to send further spear-phishing messages.
Article Details
- Attack Vectors
- Targeted spear-phishing job offers aimed at defense, aerospace, and aviation organizations; the specific approach used in the current campaign remains unclear.
- Trojanized PDF viewers and crafted PDF files delivered through encrypted ZIP archives, including websites impersonating Enveil and using SEO to promote downloads.
- DLL sideloading of libmupdf.dll, followed by in-memory payload execution.
- Exploitation of CVE-2026-68820 in the Windows AFD.sys driver for local privilege escalation.
- Use of valid Roundcube credentials followed by exploitation of CVE-2025-49113 to install RelayShell on compromised webmail servers; the article also reports RelayShell on compromised WordPress and PrestaShop servers.
- Defensive Notes
- Apply Microsoft's August 11, 2026 patch for CVE-2026-68820.
- Review and remediate Roundcube servers vulnerable to CVE-2025-49113, particularly where credentials may have been exposed.
- Investigate unexpected trojanized PDF viewers, crafted PDF files, and RelayShell on web servers.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | enveil[.]online | Impersonation website identified as distributing the trojanized PDF viewer. |
| DOMAIN | envell[.]xyz | Impersonation website identified as distributing the trojanized PDF viewer. |
| DOMAIN | uxtramine[.]org | Website listed with the SecurityPDF distribution and Troy C2 indicators. |
| IPV4 | 135[.]181[.]185[.]158 | IP address listed among the Troy command-and-control indicators. |
| IPV4 | 135[.]181[.]67[.]203 | IP address listed among the Troy command-and-control indicators. |
| SHA256 | 13d10bc99f7f7abe7ee0902be87920b73b2ea41bd9683dbfcad340dacbcdef79 | Hash listed as a MISTPEN malware indicator. |
| SHA256 | 1de949c71efcfb0ffc41f33d38833dbc4b082075b1a540fc68c18c535d7ad86c | Hash listed as a DLL loader/dropper indicator for the campaign. |
| SHA256 | 21c3ad4838c4324bc5f081021da5fb2e9073d0c9304087811c21eb47c9e22762 | Hash listed for the RelayShell webshell. |
| SHA256 | 231b1ef8b95bf77887d5377e2a60f649035e78f543af1b82877db36a5759d858 | Hash listed as a ForestTiger malware indicator. |
| SHA256 | 29e24c007549e51319ff3aee011da6f9f93568e8c85a5ad69c9e53bd3f4533a2 | Hash listed as a DLL loader/dropper indicator for the campaign. |
| SHA256 | 2b4987c07a3d9a9a5d1a9bf4efa3d1903e775090b611710edafdc92874265ca8 | Hash listed as a DLL loader/dropper indicator for the campaign. |
| SHA256 | 2db25ac41a66aa523c79e23e00443573530dd7bd82b8371bcc87bd7232e141eb | Hash listed as a MISTPEN malware indicator. |
| SHA256 | 3601060c62edeeaa49def6a13be6e126e1024ce011faad4e2d9f585ccf6bd5a6 | Hash listed as a malicious PDF payload indicator. |
| SHA256 | 396192d92d17ace1a521f1351eeeba2825e60badd0d799cc5c338e4934b3c82c | Hash listed as a DLL loader/dropper indicator for the campaign. |
| SHA256 | 3a02d0d798e8d35555776886d92b20ff38a101c9ef7e0eebc8ce5d259516525a | Hash listed as a DLL loader/dropper indicator for the campaign. |
| SHA256 | 3b6378df8442e63a6ed7317075913e4720847a510d95022d4a8347b2637c245d | Hash listed as a FudModule malware indicator. |
| SHA256 | 4c9b804d6155b29f1e27a9ffe531e10bc42a7bdab42f905b50146bf2026768d9 | Hash listed as a DLL loader/dropper indicator for the campaign. |
| SHA256 | 4dd792c9f672bbdcc8d363d745994efe90f4ffc5fdc2c059c8e379a48ad6a68a | Hash listed as a MISTPEN malware indicator. |
| SHA256 | 4ebdce2f47c23ff8c9e8e80c8b5239c7a5764da31cd3ab8f0505926890adc105 | Hash listed as a DLL loader/dropper indicator for the campaign. |
| SHA256 | 4fd32432341dfcf54d0517a6bbc38e5d265be70933493e4183c2a340cdde9a2d | Hash listed as a MISTPEN malware indicator. |
| SHA256 | 5278ee922838352f1480a73e971161017d643a80b7ec22bf725897dfd088696d | Hash listed as a MISTPEN malware indicator. |
| SHA256 | 590fb6ae19480d694e08ee85859cad8066f2f87e7e5abba2960c6d115e1615d6 | Hash listed as a Troy backdoor indicator. |
| SHA256 | 68d4fba7b1300a59cd6212c08910a260cd71b40cd9f51cac933030a68faac0bb | Hash listed as a Troy backdoor indicator. |
| SHA256 | 6da9b1e6f3315ceb77dd14a937a26cc3602bf6a7e2c2ecafb3c65ce5319837be | Hash listed as a ForestTiger malware indicator. |
| SHA256 | 72dccae85e062f541fecad9ec7a18a3123e7ae5ac5d53c91709b53a46dbbd289 | Hash listed as a ForestTiger malware indicator. |
| SHA256 | 743172aab606974b054a64561534ae66baa3a840657f79d7c6fa18350e8d45d1 | Hash listed for the trojanized SecurityPDF executable. |
| SHA256 | 75b93a7103b0562f6497d30052c0c5cf7aa58c1bf0e9297022b74469a7f096f1 | Hash listed as a DLL loader/dropper indicator for the campaign. |
| SHA256 | 82268052f94df6f4870d02e57b18d4c54136cc7a8c8d80ad162631f99462c943 | Hash listed as a ForestTiger malware indicator. |
| SHA256 | 8ce6c29f92dc45b1474417cbdff4ed0c18e58fa63e3a071ee9f85aa9d2aac07c | Hash listed as a malicious PDF payload indicator. |
| SHA256 | 92106b0c62a0a42678232f8273f030b2d3c8e92efce81b98b9eec70cfe98afa1 | Hash listed as a DLL loader/dropper indicator for the campaign. |
| SHA256 | a0578a2b7821d7e2c573530648f26d7a0d98b373ab24fb7f0c792736761e542d | Hash listed as a ForestTiger malware indicator. |
| SHA256 | a45144d22cac70a45d71cf4dffa4efbc373658779a56cf1300d6ac863d6cc7e2 | Hash listed as a DLL loader/dropper indicator for the campaign. |
| SHA256 | a673ae661593c0de9bbb815593b816a6853dad6d55ad5042d2ef1875cd13d6e7 | Hash listed as a malicious PDF payload indicator. |
| SHA256 | a738059ce07c951c31ab2da3d93d8f69bff32f9b7d933dbf5943441b9cc99075 | Hash listed as a Troy backdoor indicator. |
| SHA256 | acb97cec84e08b89f41967a24e965d1fd2c51751cef158f7aa35bb4306b87b97 | Hash listed as a malicious PDF payload indicator. |
| SHA256 | b4082d21070d9ddf53fde4ea22524d09e41ec9826ce63cef3c6235e458d21afb | Hash listed as a MISTPEN malware indicator. |
| SHA256 | ba96c603e44046de703c67b2c3b7e4ca974afef7b437a0244418bc4edc781bb7 | Hash listed as a MISTPEN malware indicator. |
| SHA256 | c2aa28bb5e2a749c693712008276f311edd912f689371ef9e8a1ee5fb4167461 | Hash listed as a DLL loader/dropper indicator for the campaign. |
| SHA256 | cc4e06aa378a190f71384c03023bb3d18a6d66e297d46701220e132963d2e222 | Hash listed for the RelayShell webshell. |
| SHA256 | d578c28c9afe7457a0d81f6701332ef8197e8f7468de654935fb29a50ea66459 | Hash listed as a malicious PDF payload indicator. |
| SHA256 | db3d69b7eeda2e35e23006bf4b7e206281fce809584207214fc213f9bc30376d | Hash listed for the trojanized SecurityPDF executable. |
| SHA256 | ea7056f2bf36c66a61ff787ff5be975a85f534c3c5ca178791dac2504db2c619 | Hash listed as a MISTPEN malware indicator. |
| SHA256 | f7e620134ca935067797ab957317b346ce0df84a4e9b9ca54a6acc9b75afda4d | Hash listed as a DLL loader/dropper indicator for the campaign. |
| SHA256 | fb3fc5626f68677fb1269a2fefbe70e719211b4065e836ab92e06a8210139a2d | Hash listed as a MISTPEN malware indicator. |
| SHA256 | fecf12088843801215898442bd1ff3e266f29d14e29a94780e857f69c4915d6b | Hash listed as a malicious PDF payload indicator. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelMISTPEN uploads collected module results to C2, and Troy supports sending files from the victim to the operator.T1055.001 · Dynamic-link Library InjectionTroy reflectively loads a DLL into a remote process; FudModule also injects a payload into a SYSTEM process.T1057 · Process DiscoveryMISTPEN's process-list module and Troy's process-list commands enumerate running processes.T1059.003 · Windows Command ShellTroy's CMD command runs command lines and captures their output on the victim host.T1068 · Exploitation for Privilege EscalationThe attackers exploited CVE-2026-68820 in AFD.sys to elevate malware privileges to SYSTEM.T1071.001 · Web ProtocolsTroy communicates with configured C2 servers over HTTP, and RelayShell uses HTTP POST requests to contact its backbone relay.T1082 · System Information DiscoveryMISTPEN reconnaissance modules collect host details including computer name, user, and operating-system information.T1083 · File and Directory DiscoveryTroy supports directory listing and drive enumeration on the compromised host.T1105 · Ingress Tool TransferMISTPEN retrieves additional modules and payloads through its C2 channel, including files hosted on OneDrive.T1113 · Screen CaptureOneScreenCapture captures the victim's desktop and returns the screenshot to MISTPEN for exfiltration.T1190 · Exploit Public-Facing ApplicationThe article reports exploitation of CVE-2025-49113 on vulnerable Roundcube webmail servers to deploy RelayShell.T1204.002 · Malicious FileThe infection chains require the victim to open the malicious PDF or launch the downloaded viewer to execute the payload.T1562.001 · Disable or Modify ToolsFudModule disables EDR visibility and suppresses security-product monitoring.T1566.001 · Spearphishing AttachmentThe campaign used spear-phishing lures and malicious PDF files delivered to targets.T1566.002 · Spearphishing LinkImpersonation websites were identified distributing the trojanized PDF viewer; the article assesses they likely separated viewer delivery from delivery of the crafted PDF.T1574.002 · DLL Side-LoadingThe first infection chain loads the malicious libmupdf.dll through DLL sideloading when the victim launches the signed PDF viewer.
CVE
CVE-2024-38193In 2024, FudModule was reported to use another zero-day, CVE-2024-38193, a use-after-free vulnerability in the same afd.sys driver.CVE-2025-49113Lazarus also used CVE-2025-49113 to exploit vulnerable Roundcube webmail servers.CVE-2025-60719At first sight, the vulnerability looked similar to CVE-2025-60719, which is also a use-after-free vulnerability in the AFD.sys driver fixed in November 2025 and not linked to any particular threat actor.CVE-2026-68820During the intrusion, the threat actor exploited CVE-2026-68820, a zero-day vulnerability in the Microsoft AFD.sys driver, to deploy a new version of FudModule, Lazarus’ kernel-mode rootkit.
Threat Actors
Malware
ForestTigerBackdoor Deployment: The final backdoor delivered by MISTPEN is the ForestTiger backdoor, a well-documented malware family widely attributed to the Lazarus threat group.FudModuleDuring the intrusion, the threat actor exploited CVE-2026-68820, a zero-day vulnerability in the Microsoft AFD.sys driver, to deploy a new version of FudModule, Lazarus’ kernel-mode rootkit.MISTPENThe executed payload is MISTPEN, a lightweight in-memory downloader that uses Microsoft Graph API to access OneDrive in order to retrieve additional modules and run them in memory.RelayShellThe compromised servers were infected with RelayShell, a PHP webshell that repurposes compromised web servers as relay nodes within the attacker’s command-and-control infrastructure.SecurityPDFIn the latest variant of the Operation Dream Job campaign, the threat actor distributed SecurityPDF, a modified PDF viewer designed to open attacker-crafted PDF documents and execute a new backdoor which we named Troy.TroyIn the latest variant of the Operation Dream Job campaign, the threat actor distributed SecurityPDF, a modified PDF viewer designed to open attacker-crafted PDF documents and execute a new backdoor which we named Troy.
Vendors
Products
Microsoft Graph APIThe executed payload is MISTPEN, a lightweight in-memory downloader that uses Microsoft Graph API to access OneDrive in order to retrieve additional modules and run them in memory.Microsoft OneDriveThe executed payload is MISTPEN, a lightweight in-memory downloader that uses Microsoft Graph API to access OneDrive in order to retrieve additional modules and run them in memory.Microsoft Windowsof the FudModule rootkit, exploiting a zero-day local privilege escalation (LPE) vulnerability in the Windows AFD.sys driver, to obtain SYSTEM privileges and disable EDR visibility.MuPDFSecurityPDF is a trojanized version of a legitimate open-source PDF viewer built on the MuPDF framework.PrestaShopIn addition, we observed the threat actor compromise PrestaShop websites and deploy the same RelayShell web shell.RoundcubeLazarus also used CVE-2025-49113 to exploit vulnerable Roundcube webmail servers.WordPressThe attackers’ command-and-control infrastructure consists of compromised Roundcube and WordPress servers hosting RelayShell, a new PHP webshell that repurposes compromised web servers as relay nodes.
Tools
Countries
BrazilThe campaign had a global reach, with activity extending into South America, including Brazil, and successful targeting observed in Western Europe, including France and Germany.DPRKThe campaign is affiliated to DPRK-linked Lazarus group and its latest wave focuses on the defense sector in Europe and India.FranceThe campaign had a global reach, with activity extending into South America, including Brazil, and successful targeting observed in Western Europe, including France and Germany.GermanyThe campaign had a global reach, with activity extending into South America, including Brazil, and successful targeting observed in Western Europe, including France and Germany.IndiaThe campaign is affiliated to DPRK-linked Lazarus group and its latest wave focuses on the defense sector in Europe and India.
Industries
AerospaceThis wave primarily targeted the defense sector worldwide, with a particular emphasis on companies operating in the aerospace and aviation industries.AviationThis wave primarily targeted the defense sector worldwide, with a particular emphasis on companies operating in the aerospace and aviation industries.DefenseCheck Point Research is tracking a long‑running campaign called Operation Dream Job, targeting organizations worldwide, with a particular focus on the defense sector.