Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor

Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor Ravie LakshmananAug 12, 2026Vulnerability / Cyber Espionage The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security flaw impacting Microsoft Windows to deliver a never-before-seen backdoor targeting defense and aerospace companies across France, Germany, Brazil, and India. The activity, per Check Point Research, is part of Operation Dream Job, a long-running cyber espionage and social engineering campaign orchestrated by Pyongyang-backed hackers to target professionals worldwide with fake-but-compelling job offers at firms like Lockheed Martin and Enveil to steal sensitive data and install malware by approaching them on platforms like LinkedIn, pretending to be recruiters in an attempt to build trust. The attacks have been found to exploit CVE-2026-68820 (CVSS score: 7.0), a privilege escalation flaw affecting Windows Ancillary Function Driver for WinSock ("AFD.sys") that was patched by Microsoft as part of its Patch Tuesday updates for August 2026. As observed in prior campaign waves, victims are lured through bogus recruiter messages and tricked into opening a malicious PDF or installing a trojanized PDF viewer, which is then used to install a new backdoor called Troy that grants remote access to the compromised machine. The end goal of these intrusions is to seize complete control of infected computers and bypass security controls. The use of a trojanized PDF viewer is a tried-and-tested tactic adopted by the Lazarus Group in conjunction with Dream Job, with the threat actors abusing this method as far back as 2022. Two different parallel infection sequences have been detected as part of the latest attacks - DLL side-loading, in which victims are instructed to download an encrypted archive that's used to trigger a DLL side-loading chain. The malicious DLL ("libmupdf.dll") is used to display a bogus job description lure, while it stealthily downloads and executes in memory a lightweight downloader dubbed MISTPEN. The downloader communicates with threat actor-controlled infrastructure using Microsoft Graph API and OneDrive to retrieve and run reconnaissance and persistence modules and trigger the "AFD.sys" driver exploit, before deploying ForestTiger (aka ScoringMathTea), which provides remote access to the host. Trojanized "SecurityPDF" PDF viewer, in which victims are instructed to download SecurityPDF from a website impersonating Enveil. Once installed, it monitors for any PDF document opened through it for a special marker ("This document is encrypted with sumatrapdf reader!!!!!!!!!!!!"). If such a marker is present, the application decrypts and launches an embedded payload that's responsible for loading a backdoor called Troy directly into memory. The DLL implant supports 17 operator commands to facilitate file enumeration, upload and download, archive and exfiltration, interactive shell access, process termination, in-memory DLL injection, and configuration updates. High-level overview of the DLL sideloading infection chain. MISTPEN, for its part, loads at least four different modules - GetInfoPlugin ("Release_GetInfoPlugin_x64.dll"), to profile the host and exfiltrate the collected information as a single wide-character string PvPlugin ("Release_PvPlugin_x64.dll"), to collect host reconnaissance data and details about running processes OneScreenCapture ("OneScreenCapture64.dll"), to take screenshots of the current desktop, including all monitors, and transmit them as JPEG images LPE (local privilege escalation) loader, which gathers host information, generates new key material using the ML-KEM post-quantum key encapsulation algorithm, and uses the negotiated key during the handshake process to decrypt and run FudModule. The attack chain employs an updated version of the known kernel-mode rootkit the Lazarus Group has repeatedly employed since at least 2022 to conceal the presence of malicious tools from security software installed on the host. One of websites that rank highly in search engine results for "Enveil SecurityPDF" Specifically, it exploits a local privilege escalation vulnerability in "AFD.sys," obtains SYSTEM privileges, and ultimately injects another instance of MISTPEN into a SYSTEM process so as to allow it to run with elevated privileges and away from the eyes of security tools. The newer version, called FudModule 3.1, improves upon its predecessor by allowing it to tamper with a Windows feature called Smart App Control designed to verify if a program is safe to run. "Within the SYSTEM-level msiexec.exe child process, its remote stub sets VerifiedAndReputablePolicyState to zero and invokes NtSetSystemInformation class 0xA4 with option 0x10000000, triggering an in-place reload of the code integrity policy," Check Point said. What's more, the attackers are said to have created at least three websites impersonating Enveil to distribute "SecurityPDF," although it's unclear how these fake portals were incorporated into the social engineering campaign. It's suspected that the adversary first sends the PDF through a phishing message and then urges them to download the PDF viewer from the site to view the document. The domain names are listed below - envell[.]xyz enveil[.]online uxtramine[.]org What's notable is that the campaign, instead of spinning up its own bespoke infrastructure, hijacks legitimate but compromised WordPress and SharePoint websites and vulnerable Roundcube webmail servers for use as ForestTiger command-and-control (C2) servers, thereby making it a lot more challenging to differentiate it from normal web traffic. Many of the Roundcube servers have been found to be vulnerable to CVE-2025-49113, with the attackers leveraging it to infect them with a previously undocumented PHP web shell codenamed RelayShell to enable the exchange of commands and responses in the form of text files. In at least one case, an already breached France-based organization was used to send phishing messages to new victims to bypass reputation-based filters. The latest findings show that Lazarus Group continues to hone its malware capabilities and tradecraft, while keeping the foundations of Dream Job largely intact in attacks aimed at critical sectors across the world. "What makes this campaign so dangerous is not only the zero-day vulnerability – but also how Lazarus wove legitimate, trusted infrastructure into every stage of the attack," Sergey Shykevich, director of threat intelligence at Check Point Software, said in a statement shared with The Hacker News. "They hid in plain sight, behind top-ranked search results, real vendor branding, and the reputation of organizations they had already compromised. "When the website, the download and the recruiter all appear authentic, the old advice to 'spot the phishing link' is no longer easily applicable. Staying safe now means assuming that trust itself can be counterfeited: patch the moment updates land, verify software through official channels rather than search rankings, and extend zero-trust thinking to the legitimate-looking sites and partners we interact with every day." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  Backdoor, cyber espionage, Malware, Nation-State, Phishing, Social Engineering, Threat Intelligence, Vulnerability, Windows Security, Zero-Day ⚡ Top Stories This Week N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories 18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP ⭐ Featured Resources Benchmark Your Defenses Against 338M+ Attack Simulations — Download the Blue Report 2026 See How to Stop the Browser-Based Attacks Your Existing Stack Misses [Book a Live Demo] [Webinar] See Where Claude Fits in the SOC and Where It Falls Short at Scale Defend Against One-Click AI Memory Poisoning — Download the Cheat Sheet