A recruiter reaches out on LinkedIn with a role at a European defense contractor, the conversation moves to a messaging app, and the next message is a password-protected archive: a coding assessment, the recruiter says, due back within the week. Inside is a digitally signed PDF viewer, a decoy resume that opens when you run it, and a DLL nobody asked to load. By the time the file finishes opening, the laptop has pulled down a kernel exploit Microsoft did not know existed.
Check Point Research tied that lure to Operation Dream Job, the North Korea-linked Lazarus group's long-running fake-recruiter campaign, and to a Windows kernel bug Microsoft patched on August 11 as CVE-2026-68820. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a remediation deadline of August 25. Lazarus had been running the exploit against real targets since early July, roughly five weeks before the fix shipped.
The direct targets were narrow: defense, aerospace, and drone and robotics companies in France, Germany, India, and Brazil, the kind of organization Lazarus goes after for espionage rather than a quick payout. If none of that describes your business, this specific campaign was not built for you. What applies regardless: the flaw underneath it sits in a driver every Windows 11 24H2 and 25H2 machine loads, and a patched local privilege-escalation bug has a habit of showing up in commodity malware within weeks once the mechanics are public. If you run unpatched Windows 11 anywhere, or your endpoint detection depends on the same telemetry sources this rootkit is designed to blind, the mechanics below are worth five minutes even without a nation-state actor in your threat model.
How a fake job offer delivered a kernel exploit
Two delivery chains fed the same outcome. In the first, victims received an encrypted ZIP containing a legitimately signed PDF viewer alongside a malicious DLL, libmupdf.dll, positioned for sideloading. Running the viewer displayed a decoy PDF while the DLL launched MISTPEN, an in-memory downloader that talks to its operators through the Microsoft Graph API and OneDrive rather than a dedicated command server. MISTPEN pulled down reconnaissance modules to fingerprint the host and its security stack, dropped a persistence stage, then loaded an exploitation module built specifically to weaponize CVE-2026-68820.
The second chain used a trojanized viewer called SecurityPDF: a modified MuPDF build paired with a crafted PDF that the viewer detects through an embedded marker string, decrypts, and executes to launch a second implant, a backdoor Check Point named Troy after a string in its debug path. Troy supports 17 operator commands, from directory listing and file transfer to reflective DLL injection into a remote process, enough to run an entire intrusion without ever dropping a second-stage tool to disk. Attackers ran both chains behind lookalike recruiting sites, some of which ranked on the first page of search results, splitting delivery across stages specifically to slow down analysis.
Once the exploitation module ran, it fingerprinted the host, exchanged keys with its controller using a post-quantum key-exchange algorithm, and delivered the local privilege-escalation payload that turned a standard user session into SYSTEM. From there it dropped the FudModule kernel rootkit and, on longer-term targets, a persistence backdoor called ForestTiger. Separately, Check Point tracked a related infrastructure cluster, RelayShell, a web shell deployed on compromised Roundcube and PrestaShop servers through an unrelated authenticated deserialization bug, CVE-2025-49113, giving the group a second command channel that never touches an endpoint's own EDR agent at all. None of the endpoint compromise required a single unpatched network service. Every step happened after a person opened a file.
The race condition inside AFD.sys
The Windows Ancillary Function Driver for WinSock, afd.sys, is the kernel component behind every socket operation the Windows Sockets API performs, meaning almost every process on the machine touches it indirectly. CVE-2026-68820 is a use-after-free, tracked under CWE-416, in how that driver handles concurrent access to socket state: two code paths can operate on the same socket object at the same time without proper synchronization. Win one race and a thread frees memory that a second code path still holds a reference to. Reallocate that freed memory fast enough with attacker-controlled content, and the second path reads or writes through it as if nothing happened, handing the attacker a kernel read and write primitive.
Microsoft's advisory rates the bug 7.0 on CVSS and requires local, authenticated access to trigger it. There is no remote, unauthenticated path here, which is exactly why it showed up bundled behind a phishing lure instead of as a standalone internet-facing exploit. A kernel read and write primitive does not need a network path to be dangerous. It needs one process already running on the box, which the DLL sideload had already provided by the time the exploit fired.
What FudModule does once it has SYSTEM
FudModule is not new. AhnLab and ESET first documented it in 2022 riding a bring-your-own-vulnerable-driver technique, installing a signed but flawed third-party driver just to get a foothold in the kernel. Avast's 2024 analysis showed Lazarus drop the extra driver entirely and exploit an admin-to-kernel zero-day already built into Windows instead. CVE-2026-68820 continues that trajectory: the vulnerable code ships on every unpatched Windows 11 machine, no extra driver required. Check Point's analysis of the version deployed in this campaign, timestamped July 7, shows a rootkit built specifically for the 26100 (24H2) and 26200 (25H2) builds.
What changed in this version
- Telemetry suppression, broadened. The rootkit terminates process, thread, and image-load notify callbacks and kills ETW providers outright, denying an EDR agent the kernel-level signals most products depend on rather than just tampering with one product's driver.
- A hardcoded list of 94 security-product identifiers it checks for and attempts to disable, spanning the major EDR and antivirus vendors rather than one target.
- The dedicated stage that used to suspend Microsoft Defender specifically is gone, replaced by the generic suppression above. Narrower code, broader effect.
- Smart App Control tampering, a capability not present in earlier FudModule builds, using a documented but rarely called system information class to weaken code-integrity enforcement in place.
- SYSTEM-level process spawning to relaunch its own downloader with elevated rights, keeping its command channel alive from a position most detection logic does not expect a routine process launch to come from.
The pattern across every change is the same: less product-specific tampering, more generic blinding of the telemetry pipeline every EDR agent depends on regardless of vendor. That is the part worth remembering after the headlines about Lazarus move on.
Hunt the behavior, not just the hash
File hashes and command-and-control domains from this specific campaign will rotate the moment Lazarus reads its own press coverage. What does not rotate as easily is the shape of the behavior Check Point documented: a signed, ordinary-looking application sideloading a DLL, a process reaching SYSTEM through a driver that has no business granting it, and a security product going quiet at the exact moment a rootkit needs it to. Start with confirming the patch, then hunt for that shape.
# Confirm the endpoint is actually running the patched driver rather than
# trusting an update-compliance dashboard. afd.sys ships with the OS build,
# so compare the file version directly against the August 11 fix for your
# build (26100.x for 24H2, 26200.x for 25H2) in Microsoft's advisory.
Get-Item "$env:SystemRoot\System32\drivers\afd.sys" |
Select-Object -ExpandProperty VersionInfo |
Format-List FileVersion, ProductVersion, LastWriteTime
# Hunting hypothesis for the FudModule tell Check Point documented: SYSTEM
# spawning msiexec.exe from a process ancestry that does not look like a
# normal installer flow. Run against Defender for Endpoint advanced hunting.
DeviceProcessEvents
| where FileName =~ "msiexec.exe"
| where AccountDomain =~ "nt authority" and AccountName =~ "system"
| where InitiatingProcessParentFileName !in~ ("services.exe","svchost.exe","explorer.exe","msiexec.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessParentFileName, ProcessCommandLine, AccountNamePair that hunt with a check on your EDR's own health telemetry: a sudden, unexplained gap in ETW-sourced events from a single endpoint, especially one that coincides with a signed PDF or document viewer launching a child process it has never spawned before, is worth a look even when nothing else fires. Cross-reference any hits against the indicators Check Point published in its report, including the envell[.]xyz and enveil[.]online infrastructure and the DLL, MISTPEN, and Troy sample hashes, before deciding a hit is a false positive.
Assume five weeks of compromise, not just a missing patch
Patch CVE-2026-68820 this week if you have not already; CISA's August 25 deadline is the floor, not the target. The patch closes the door. It does not prove nobody already walked through it. Lazarus had five weeks of head start before Microsoft's fix existed, and this campaign specifically targeted organizations whose compromise would matter for months rather than for one news cycle. Run the hunting queries above against every Windows 11 endpoint that could plausibly have been exposed since early July, and if you cannot confidently say your EDR would have caught the telemetry suppression stage, that gap is the finding to act on, independent of whether Lazarus was ever actually in your environment.
Need an incident response plan before the next kernel zero-day drops?
We help organizations build and test incident response playbooks, and assess whether their EDR telemetry would survive a rootkit built to blind it. Book a session to talk through your environment.