Updated
Updated · The Hacker News · Aug 14
Lazarus Exploits Windows Zero-Day CVE-2026-68820, Deploys 17-Command Troy Backdoor
Updated
Updated · The Hacker News · Aug 14

Lazarus Exploits Windows Zero-Day CVE-2026-68820, Deploys 17-Command Troy Backdoor

3 articles · Updated · The Hacker News · Aug 14

Summary

  • Check Point linked Lazarus Group to June exploitation of CVE-2026-68820, a Windows AFD.sys privilege-escalation flaw patched in August, in attacks on defense and aerospace targets in France, Germany, Brazil and India.
  • Fake recruiter lures tied to Operation Dream Job pushed victims to open malicious PDFs or install a trojanized “SecurityPDF” viewer, which loaded the new Troy backdoor or triggered a DLL side-loading chain ending in ForestTiger access.
  • SYSTEM-level access came through the zero-day exploit, while MISTPEN fetched reconnaissance, persistence and screenshot modules and used Microsoft Graph API and OneDrive for command delivery.
  • FudModule 3.1 then hid the intrusion and tampered with Windows Smart App Control, while Troy supported 17 commands including file theft, shell access, process killing and in-memory DLL injection.
  • At least three fake Enveil-themed sites distributed the malware, and Lazarus also used compromised WordPress, SharePoint and vulnerable Roundcube servers—including one breached French organization—to blend command traffic with legitimate infrastructure.

Insights

How did a simple fake job offer trigger a catastrophic Windows zero-day breach in global defense networks?
What makes the Lazarus Group's newest kernel-level rootkit virtually invisible to modern cybersecurity defenses?
Could emails from your trusted corporate partners actually be a hidden gateway for state-sponsored espionage?