Lazarus Exploits Windows Zero-Day CVE-2026-68820, Deploys 17-Command Troy Backdoor
Updated
Updated · The Hacker News · Aug 14
Lazarus Exploits Windows Zero-Day CVE-2026-68820, Deploys 17-Command Troy Backdoor
3 articles · Updated · The Hacker News · Aug 14
Summary
Check Point linked Lazarus Group to June exploitation of CVE-2026-68820, a Windows AFD.sys privilege-escalation flaw patched in August, in attacks on defense and aerospace targets in France, Germany, Brazil and India.
Fake recruiter lures tied to Operation Dream Job pushed victims to open malicious PDFs or install a trojanized “SecurityPDF” viewer, which loaded the new Troy backdoor or triggered a DLL side-loading chain ending in ForestTiger access.
SYSTEM-level access came through the zero-day exploit, while MISTPEN fetched reconnaissance, persistence and screenshot modules and used Microsoft Graph API and OneDrive for command delivery.
FudModule 3.1 then hid the intrusion and tampered with Windows Smart App Control, while Troy supported 17 commands including file theft, shell access, process killing and in-memory DLL injection.
At least three fake Enveil-themed sites distributed the malware, and Lazarus also used compromised WordPress, SharePoint and vulnerable Roundcube servers—including one breached French organization—to blend command traffic with legitimate infrastructure.