Lazarus Used Windows Zero-Day in Operation Dream Job Attacks on Defense Targets
Summary
Check Point reports Lazarus used Windows zero-day CVE-2026-68820 in Operation Dream Job attacks on defense, aerospace and aviation targets, deploying FudModule, Troy and RelayShell. Microsoft patched the flaw in its latest Patch Tuesday updates.
Key points
- Microsoft patched CVE-2026-68820, a use-after-free in Windows AFD.sys that can let a locally authenticated attacker gain SYSTEM privileges; Microsoft marked it actively exploited.
- Check Point researchers say Lazarus exploited the flaw since early July, with the exploit supporting Windows 11 builds 26100 and 26200.
- The Operation Dream Job campaign used fraudulent recruitment offers to target defense, aerospace and aviation organizations in Europe and India.
- A new FudModule kernel-mode rootkit variant incorporated the exploit and reportedly can disable EDR telemetry and tamper with Smart App Control.
- Researchers reported a new Troy backdoor with capabilities including reconnaissance, file operations, hidden command execution and in-memory DLL injection.
- Check Point observed compromised Roundcube servers and a PHP web shell called RelayShell; researchers say attackers likely used leaked credentials before exploiting CVE-2025-49113.
- Researchers identified at least 17 servers infected with RelayShell and shared indicators of compromise and a YARA rule for detection.
Article Details
- Event Type
- Zero-day exploitation and targeted intrusion campaign
- Impact
- Lazarus exploited CVE-2026-68820 to gain SYSTEM privileges on targeted Windows systems in the Operation Dream Job campaign. The reported targets included defense, aerospace, and aviation organizations. Check Point reported that attackers also used Troy and RelayShell, and identified at least 17 servers infected with RelayShell. Attackers likely used leaked credentials and CVE-2025-49113 to compromise Roundcube installations.
MITRE ATT&CK
T1055.001 · Dynamic-link Library InjectionThe Troy backdoor supports in-memory DLL injection.T1068 · Exploitation for Privilege EscalationLazarus used CVE-2026-68820 to elevate privileges to SYSTEM on targeted Windows systems.T1078 · Valid AccountsThe attacker likely used leaked credentials to authenticate to Roundcube.T1190 · Exploit Public-Facing ApplicationThe attackers likely exploited CVE-2025-49113 in vulnerable Roundcube installations to obtain remote code execution.T1505.003 · Web ShellRelayShell was deployed as a web shell on compromised Roundcube servers.T1562.001 · Disable or Modify ToolsThe FudModule rootkit can disable EDR telemetry and interfere with security products, according to the researchers.
CVE
CVE-2025-49113The attacker likely used leaked credentials to authenticate to Roundcube before exploiting CVE-2025-49113, an authenticated PHP object-deserialization vulnerability, to obtain remote code execution.CVE-2026-68820North Korean hackers linked to Lazarus are exploiting the Windows zero-day CVE-2026-68820 in the Operation Dream Job campaign to gain SYSTEM privileges on targeted systems.
Threat Actors
Malware
FudModuleThe attacks have focused on defense, aerospace, and aviation organizations, while also using the FudModule rootkit, the Troy backdoor, and the RelayShell web shell to expand access and evade defenses.RelayShellThe attacks have focused on defense, aerospace, and aviation organizations, while also using the FudModule rootkit, the Troy backdoor, and the RelayShell web shell to expand access and evade defenses.TroyThe attacks have focused on defense, aerospace, and aviation organizations, while also using the FudModule rootkit, the Troy backdoor, and the RelayShell web shell to expand access and evade defenses.
Vendors
Products
Microsoft WindowsNorth Korean hackers linked to Lazarus are exploiting the Windows zero-day CVE-2026-68820 in the Operation Dream Job campaign to gain SYSTEM privileges on targeted systems.Roundcube WebmailCompromised Roundcube servers and leaked credentials were used to support intrusion activity.Windows 11The exploit was embedded in a new FudModule rootkit variant for Windows 11.
Countries
Brazil“The campaign had a global reach, with activity extending into South America, including Brazil, and successful targeting observed in Western Europe, including France and Germany.”FranceIn at least one case, the threat actor compromised an organization in France and used it in spear-phishing attacks on additional targets.Germany“The campaign had a global reach, with activity extending into South America, including Brazil, and successful targeting observed in Western Europe, including France and Germany.”IndiaA recent wave of the long-standing Operation Dream Job campaign has been targeting defense, aerospace, and aviation organizations in Europe and India, using fraudulent recruitment offers to employees in target entities.
Industries
AerospaceThe attacks have focused on defense, aerospace, and aviation organizations, while also using the FudModule rootkit, the Troy backdoor, and the RelayShell web shell to expand access and evade defenses.AviationThe attacks have focused on defense, aerospace, and aviation organizations, while also using the FudModule rootkit, the Troy backdoor, and the RelayShell web shell to expand access and evade defenses.DefenseThe attacks have focused on defense, aerospace, and aviation organizations, while also using the FudModule rootkit, the Troy backdoor, and the RelayShell web shell to expand access and evade defenses.