Check Point: Lazarus-Linked Campaign Exploited Windows Zero-Day CVE-2026-68820
Summary
Check Point reports that a Lazarus-linked campaign targeting defense and aerospace organizations used Windows zero-day CVE-2026-68820 and several backdoors. Microsoft patched the flaw on August 11; CISA added it to its KEV catalog.
Key points
- Check Point attributes the campaign to Lazarus Group and describes it as a continuation of Operation Dream Job, targeting defense, aerospace, and aviation organizations in several countries.
- Attackers reportedly posed as recruiters and used malicious downloads delivered through professional platforms or direct messages.
- One infection chain used DLL sideloading to run the Mistpen downloader, followed by exploitation of the afd.sys use-after-free flaw to gain System privileges and deployment of the ForestTiger backdoor.
- A second chain used a trojanized PDF viewer, SecurityPDF, to execute the Troy backdoor in memory; Troy supports commands including file transfer, data exfiltration, shell access, and DLL injection.
- Check Point says the attackers used compromised Roundcube and CMS servers as command-and-control infrastructure, including servers vulnerable to CVE-2025-49113, and a previously undocumented PHP webshell called RelayShell.
- Microsoft patched CVE-2026-68820 on August 11, and CISA added it to the Known Exploited Vulnerabilities catalog. Check Point advised targeted organizations to apply the update and scrutinize unsolicited recruiting downloads.
Article Details
- Attack Vectors
- Attackers posing as recruiters contacted potential victims through professional platforms or direct messaging and persuaded them to download a malicious payload.
- An infection chain delivered an archive containing a PDF viewer, a malicious DLL, and an encrypted payload disguised as a PDF; DLL sideloading executed the Mistpen downloader in memory.
- A second infection chain used the trojanized SecurityPDF viewer to find a hidden marker in opened PDF files and execute the Troy backdoor in memory.
- The attackers exploited the Windows afd.sys zero-day CVE-2026-68820 to trigger a race condition and gain System privileges.
- Compromised Roundcube webmail deployments and CMS platforms were used as command-and-control infrastructure; Check Point says many were vulnerable to CVE-2025-49113.
- Defensive Notes
- Prioritize the August Patch Tuesday update that fixes CVE-2026-68820; CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and urged federal agencies to patch within two weeks.
- Review indicators of compromise and scrutinize unsolicited recruiting outreach, especially requests to download files.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe infection chain included an encrypted payload disguised as a PDF file.T1055 · Process InjectionTroy supports an operator command for DLL injection.T1068 · Exploitation for Privilege EscalationThe afd.sys zero-day CVE-2026-68820 allowed attackers to trigger a race condition and gain System privileges.T1105 · Ingress Tool TransferThe infection chain delivered an archive containing malicious components, and Troy supports operator file download and upload commands.T1204.002 · Malicious FileVictims were convinced to download and open a malicious archive containing a PDF viewer, DLL, and encrypted payload.T1566.003 · Spearphishing via ServiceAttackers posing as recruiters contacted potential victims through professional platforms or direct messaging to persuade them to download a payload.T1574.002 · DLL Side-LoadingDLL sideloading was used to execute the Mistpen malware downloader in memory.
CVE
CVE-2025-49113attacks includes compromised Roundcube webmail deployments and CMS platforms, many vulnerable to CVE-2025-49113, a remote code execution (RCE) flaw that has been exploited since June 2025.CVE-2026-68820The afd.sys zero-day, now tracked as CVE-2026-68820, is a use-after-free issue that allows attackers to trigger a race condition and gain System privileges.
Threat Actors
Malware
ForestTigerin Windows’ Ancillary Function Driver for WinSock (afd.sys), followed by the deployment of ForestTiger, a known Lazarus backdoor.MISTPENpayload posing as a PDF file is served to the victim, and DLL sideloading is used to execute the Mistpen malware downloader in memory while a decoy job description is shown on the screen.RelayShell“These servers are infected with RelayShell, a previously undocumented PHP webshell that functions less like a conventional backdoor and more as a communication relay between infected endpoints and the operator,Troyviewer SecurityPDF, which searches for a hidden marker in any PDF file opened on the system to execute the Troy backdoor directly in memory.
Vendors
Products
Microsoft WindowsNorth Korean hackers have been exploiting a newly patched Windows zero-day vulnerability to take over victims’ systems, Check Point reports.Roundcube WebmailThe command-and-control (C&C) infrastructure observed in these attacks includes compromised Roundcube webmail deployments and CMS platforms, many vulnerable to CVE-2025-49113, a remote code execution (RCE) flaw that hasSecurityPDFAccording to Check Point, a second infection chain directs users to the trojanized PDF viewer SecurityPDF, which searches for a hidden marker in any PDF file opened on the system to execute the Troy backdoor directly in
Countries
BrazilThe cybersecurity firm says that defense, aerospace, and aviation organizations in France, Germany, Brazil, and India have been targeted in the fresh campaign.FranceThe cybersecurity firm says that defense, aerospace, and aviation organizations in France, Germany, Brazil, and India have been targeted in the fresh campaign.GermanyThe cybersecurity firm says that defense, aerospace, and aviation organizations in France, Germany, Brazil, and India have been targeted in the fresh campaign.IndiaActive since early 2026, the new campaign has been targeting the defense sector across multiple countries, mainly aerospace and aviation organizations in Europe and India, Check Point says.
Industries
AerospaceActive since early 2026, the new campaign has been targeting the defense sector across multiple countries, mainly aerospace and aviation organizations in Europe and India, Check Point says.AviationActive since early 2026, the new campaign has been targeting the defense sector across multiple countries, mainly aerospace and aviation organizations in Europe and India, Check Point says.DefenseActive since early 2026, the new campaign has been targeting the defense sector across multiple countries, mainly aerospace and aviation organizations in Europe and India, Check Point says.