Dream Job now ships a kernel exploit: Lazarus pairs recruiter lures with a fresh AFD zero-day

Check Point reported on Tuesday that North Korea's Lazarus Group has renewed its Operation Dream Job campaign and is now exploiting a Windows zero-day that was patched this week to help spread its backdoors ^[1]. The lure is unchanged - a fake recruiter with a job description to open ^[3] - but one of the two chains Check Point documented now ends with a rootkit holding kernel privileges ^[8], which is a different class of incident than a user opening a document they should not have.

The targeting is narrow. Fraudulent job offers, purportedly from well-known companies, arrive by direct message or through platforms like LinkedIn, aimed mainly at defense and aerospace organisations in Europe and India ^[2].

In the first chain, the victim gets an archive holding a malicious DLL, an encrypted payload disguised as a PDF, and a legitimate, digitally signed PDF viewer called SmartaPDF.exe ^[4]. Launching the viewer sideloads libmupdf.dll, which decrypts the payload, shows a decoy PDF, and runs a downloader called MISTPEN ^[5]. MISTPEN talks to attacker infrastructure over the Microsoft Graph API and OneDrive, runs reconnaissance and persistence modules, then escalates through CVE-2026-68820 for kernel access ^[6]. That bug is a use-after-free privilege escalation in the Windows Ancillary Function Driver for WinSock ^[7]. The kernel access is used to deploy FudModule v3.1, which disables logging, suppresses security software, and in this version also disrupts Smart App Control ^[8]. The chain finishes with the previously documented ForestTiger backdoor ^[14].

Denis Calderone, CTO at Suzu Labs, told SC Media by email that this is at least the third time in two years Lazarus has exploited a built-in Windows driver to deploy FudModule, after CVE-2024-21338 in appid.sys and CVE-2024-38193 in AFD.sys ^[19]. Two of those three were AFD.sys ^[21]. Calderone framed it as an adaptation: the old playbook was bring-your-own-vulnerable-driver, defenders answered with driver allowlisting, and Lazarus moved to drivers Windows ships by default, noting that AFD.sys handles every socket operation on every Windows machine and cannot be blocklisted ^[20].

The second chain does not need a kernel bug. Victims are pointed at a trojanized viewer called SecurityPDF, hosted on a domain impersonating the privacy technology firm Enveil ^[9]. The viewer looks for a hidden marker in any PDF it opens and launches an embedded payload when it finds one ^[10], loading a new backdoor called Troy directly in memory ^[11]. Troy supports 17 commands, including interactive shell, process termination, in-memory DLL injection, and file enumeration, upload, download, archiving and exfiltration ^[12].

Infrastructure is increasingly borrowed rather than rented. Check Point said Lazarus is serving ForestTiger from compromised WordPress and Roundcube Webmail servers, many of the latter vulnerable to the RCE flaw CVE-2025-49113, several carrying a PHP webshell the researchers call RelayShell ^[13][16]. Check Point counted at least 17 unique server identifiers in the relay network and saw operators connecting through commercial VPNs ^[17].

The patch math is where this bites. Check Point reported the flaw to Microsoft and it shipped in the August 2026 Patch Tuesday, which fixed more than 400 issues ^[15]; per Calderone it carries CVSS 7.0 and an Important rating, alongside 42 Critical patches in the same release ^[18]. So at least 358 non-Critical fixes competed for attention that month, and the one being exploited was among them ^[23]. CISA added it to the Known Exploited Vulnerabilities catalog with a federal patch deadline of August 25 ^[22].

Watch whether Smart App Control tampering shows up in detections outside this campaign, and whether the Roundcube relay network keeps growing while CVE-2025-49113 goes unpatched on small hosts.