Operation Dream Job: Lazarus Exploits a Windows Zero-Day to Deploy Backdoor

Lazarus has been exploiting the Windows zero-day vulnerability CVE-2026-68820 as part of its long-running Operation Dream Job campaign, and each intrusion opened with a recruitment lure. Posing as recruiters for well-known defense and technology firms, the group approached targets, most likely over LinkedIn or messaging apps, and steered them toward downloading malicious files. Two delivery paths ran in parallel. In the first, the victim received an encrypted ZIP holding a legitimately signed PDF viewer, a malicious DLL, and an encrypted payload disguised as a PDF; launching the viewer side-loaded the rogue libmupdf.dll, which showed a convincing decoy job description while quietly unpacking and running code in memory. In the second, victims were told to install "SecurityPDF," a trojanized open-source PDF viewer offered through at least three fake Enveil websites that ranked highly in search results, and opening a specially prepared PDF through it triggered a hidden payload.

Once running, the first chain loaded MISTPEN, an in-memory downloader that profiled the machine and pulled additional modules for host and process reconnaissance, screenshot capture, and privilege escalation. MISTPEN reached its operators through legitimate cloud services, using the Microsoft Graph API and OneDrive to blend in with normal traffic. Its privilege-escalation loader negotiated a session key using the ML-KEM post-quantum algorithm, then used that key to decrypt and run FudModule 3.1, Lazarus's kernel-mode rootkit. The second chain instead decrypted and loaded the Troy backdoor directly into memory, handing operators remote control through 17 commands covering reconnaissance, file upload and download, archiving and exfiltration, hidden shell execution, process termination, in-memory DLL injection, and changes to beacon timing.

To gain SYSTEM privileges, the attackers exploited CVE-2026-68820, a use-after-free flaw in the Windows AFD.sys WinSock driver that had not yet been patched when the campaign began in early July. With SYSTEM access, FudModule 3.1 worked to blind defenders by disabling EDR telemetry, interfering with security products, and, in a new twist, tampering with Windows Smart App Control by resetting its policy state and forcing an in-place reload of the code-integrity policy from within a SYSTEM-level msiexec.exe process. The rootkit also injected a fresh copy of MISTPEN into a SYSTEM process so the implant could run with elevated rights and out of sight of monitoring tools.

Rather than build its own servers, Lazarus hid inside trusted infrastructure. The group hijacked legitimate but compromised WordPress and SharePoint sites and Roundcube webmail servers to relay command-and-control traffic for ForestTiger, its remote-access implant. Many of those Roundcube servers still ran versions vulnerable to CVE-2025-49113, so the attackers likely authenticated with stolen credentials and then exploited the PHP object-deserialization flaw to plant RelayShell, a previously undocumented web shell that exchanges commands and results as text files. In at least one case a compromised France-based organization was used to send spear-phishing to fresh targets, letting the messages slip past reputation-based filters. Data collected on victim hosts was staged, archived, and exfiltrated over these blended channels.