FudModule

Reported Context (2)

to exploitation of CVE-2026-68820 in Windows AFD.sys, SYSTEM access, and deployment of the EDR-blinding FudModule rootkit. Compromised Roundcube and WordPress servers relayed command-and-control traffic. Microsoft AI-Assisted Taiwan Campaign, OpenAI Testing Pause and Other Cybersecurity News
During the intrusion, the threat actor exploited CVE-2026-68820, a zero-day vulnerability in the Microsoft AFD.sys driver, to deploy a new version of FudModule, Lazarus’ kernel-mode rootkit. Lazarus Uses AFD.sys Zero-Day in Operation Dream Job Campaign Targeting Defense Sector

CVE (5)

Malware (7)

People (3)

Threat Actors (1)

MITRE ATT&CK (16)

Vendors (13)

Products (22)

Tools (2)

Industries (4)

Countries (7)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.