Lazarus Group’s Windows Zero-Day: A Fake Lockheed Martin Job Offer With a Kernel Rootkit Attached

A Job Offer That Was Actually a Rootkit Delivery System

Social-engineering lures don’t get more specifically targeted than a fake job posting from a real defense contractor sent to the exact professionals who’d want that job. Check Point Research documented that Lazarus Group — the North Korean state-sponsored threat actor — ran a campaign using a decoy PDF displaying a Lockheed Martin job description, alongside a second lure impersonating Enveil, a privacy-enhancing-technology company, to approach defense and aerospace professionals. The campaign specifically targeted organizations developing military technologies including surveillance sensors, drones, and robotics, with confirmed targets in France, Germany, India, and Brazil. BleepingComputer’s independent reporting corroborates the campaign’s defense-sector focus and confirms the zero-day was used specifically to deploy a previously unseen backdoor against the targeted aerospace and defense firms.

The technical chain behind that lure is where the campaign becomes genuinely dangerous rather than merely convincing. Victims who opened the lure encountered one of two infection paths: an encrypted ZIP file containing a legitimate, signed PDF viewer alongside a malicious DLL (libmupdf.dll) that loads via DLL sideloading while displaying the decoy job posting, or a trojanized PDF viewer called “SecurityPDF” — a modified version of the open-source MuPDF viewer — distributed through impersonation websites. Specially crafted PDFs opened in the trojanized viewer contain a literal marker string reading “This document is encrypted with sumatrapdf reader!!!!!!!!!!!!!!!” before a single-byte XOR decryption using the key 0x39 extracts an embedded backdoor.

From Downloader to Kernel Rootkit in One Chain

Once execution begins, the chain escalates quickly. Both infection paths deploy MISTPEN, a lightweight in-memory downloader that establishes reconnaissance and persistence before triggering the campaign’s actual weapon: CVE-2026-68820, a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys). Microsoft’s own advisory confirms the flaw lets a low-privileged local attacker elevate to SYSTEM privileges by triggering a race condition, and — critically for defenders — requires no user interaction once the attacker already has code execution on the machine, meaning the fake job offer was purely the entry vector, not the whole attack.

With SYSTEM-level access secured, Lazarus deploys ForestTiger, a well-documented backdoor previously attributed to the group, alongside an updated version of FudModule — a kernel-mode rootkit specifically engineered to interfere with security monitoring tools from inside the operating system’s own privilege ring. A rootkit operating at that level can blind or disable endpoint detection software running on the same machine, which is precisely why the privilege-escalation step matters as much as initial access: without SYSTEM rights, FudModule cannot install itself deep enough to evade the security tooling defenders rely on to catch it.

A Five-Week Window Between Exploitation and Patch

The timeline Check Point documented shows real precision on both sides — the attackers’ and the defenders’. Forensic evidence, including a compile timestamp on the FudModule binary, dates the campaign wave to at least July 7, 2026. Check Point reported the vulnerability to Microsoft on July 28, 2026; Microsoft confirmed the bug on July 31; the CVE identifier was assigned August 5; and the patch shipped August 11, 2026 as part of that month’s Patch Tuesday release, which addressed more than 400 vulnerabilities total. Tech Times’ reporting on the disclosure timeline frames the same sequence explicitly as a five-week exploitation window, underscoring that Lazarus had a functioning zero-day privilege-escalation exploit in active use against real defense-sector targets well before Microsoft’s disclosure-to-patch process even began.

That gap is the uncomfortable reality of zero-day economics: even a well-run, fast coordinated disclosure process — Microsoft moved from bug confirmation to shipped patch in 11 days once Check Point reported it — still leaves a multi-week period where a nation-state actor with a working kernel exploit operates against real targets with no available defense beyond detection and behavioral analysis. Notably, security researchers observed that August 2026’s high patch volume did not come with a proportional spike in actively-exploited zero-days across the broader Patch Tuesday release — meaning CVE-2026-68820 wasn’t part of a wider exploitation wave, but a targeted, single-campaign weapon.

The choice of AFD.sys as the exploitation target is itself notable from a defensive standpoint. The Ancillary Function Driver for WinSock is a core kernel-mode component that processes essentially all socket operations Windows applications make through the standard sockets API — meaning it runs on every Windows machine handling any form of network communication, giving Lazarus a near-universal escalation path once initial code execution is achieved, regardless of what specific software or configuration a given defense contractor happens to run. That universality is precisely what makes a driver-level vulnerability more valuable to a well-resourced state actor than an application-specific bug: it works across the full diversity of a target organization’s Windows fleet without requiring reconnaissance of which specific third-party software each machine happens to have installed.

What This Means for Defense-Sector Organizations and Their Vendors

1. Treat recruiter outreach with defense-industry lures as a specific, elevated risk category

Given that this campaign specifically weaponized realistic job offers from named real companies (Lockheed Martin, Enveil), defense and aerospace organizations should brief employees — especially those in technical or engineering roles handling sensitive programs — that unsolicited recruiter contact bearing document attachments, even ones referencing real, recognizable companies, warrants verification through a separate channel before opening.

2. Patch CVE-2026-68820 immediately and verify AFD.sys is current across your fleet

Since the vulnerability requires no user interaction once an attacker has local code execution, any unpatched Windows system remains exposed to privilege escalation even if your organization successfully blocks the initial phishing vector. Confirm the August 11, 2026 patch is deployed across all Windows endpoints, not just systems believed to be at elevated risk.

3. Assume kernel-level rootkit tooling can defeat your existing endpoint detection

FudModule’s specific design goal — disabling security monitoring from inside the kernel — means organizations in defense, aerospace, and adjacent sectors should not rely solely on endpoint detection and response tools to catch this class of attack. Layer in network-level anomaly detection and out-of-band log forwarding that a compromised endpoint cannot itself tamper with, since a successful FudModule deployment specifically aims to blind the very tools most organizations depend on for detection.

The Recruiting Lure That Keeps Working

Operation Dream Job has run for years precisely because it exploits something security awareness training struggles to fully counter: professional ambition. A realistic job offer from a real, recognizable defense contractor is a harder lure to resist than a generic phishing email, and Lazarus has now paired that proven social-engineering approach with a genuine kernel-level zero-day rather than commodity malware. The five-week gap between confirmed exploitation and an available patch is a reminder that the most dangerous phase of any zero-day campaign is the one that happens before anyone outside the attacker and, eventually, the vendor, knows it exists — which is exactly why the defense-sector organizations named as targets in this campaign needed behavioral and network-level detection capable of catching a novel technique, not just a patched vulnerability list.

Frequently Asked Questions

Sources & Further Reading

• Shattering the Dream — When a Job Offer Becomes a Zero-Day Attack — Check Point Research
• Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820) — Help Net Security
• Lazarus hackers exploited Windows zero-day to target defense firms — BleepingComputer
• Lazarus Group Hacked Defense Workers With Windows Kernel Zero-Day for Five Weeks — Tech Times