Inside Operation Dream Job: Lazarus Group Weaponizes a Windows Zero-Day

Summary

Lazarus Group has expanded its long-running Operation Dream Job campaign by combining convincing employment-themed social engineering with the exploitation of a newly patched Windows zero-day. The campaign targets professionals associated with defense and aerospace organizations, using fake recruiter communications, malicious PDF documents, trojanized software, and compromised infrastructure to establish access. The attackers exploited CVE-2026-68820, a Windows Ancillary Function Driver for WinSock (AFD.sys) privilege escalation vulnerability, to obtain SYSTEM-level privileges and deploy additional malware. The campaign demonstrates how social engineering, zero-day exploitation, signed or trusted-looking software, and compromised legitimate infrastructure can be combined into a multi-stage cyber-espionage operation.

Background of Lazarus Group

Lazarus Group is a North Korea-linked threat actor known for conducting cyber-espionage, financial theft, and destructive operations against organizations worldwide. The group has targeted government agencies, defense and aerospace organizations, financial institutions, technology companies, and cryptocurrency-related businesses. Its operations commonly combine social engineering, custom malware, compromised infrastructure, and exploitation of software vulnerabilities.

One of its notable campaigns, Operation Dream Job, uses fake employment opportunities and recruiter communications to target professionals in high-value industries. Attackers typically build trust with victims before delivering malicious documents, links, or software disguised as legitimate job-related tools. The latest activity shows the campaign evolving beyond social engineering by incorporating CVE-2026-68820, a Windows zero-day used to escalate privileges and deploy additional malware.

Vulnerability Details

CVE ID	CVSS Score	EPSS Score	Affected Component	Vulnerability Type
CVE-2026-68820	7.0 (High)	0.33%	Windows Ancillary Function Driver	Privilege Escalation

Attack Methodology

• Phase 1: Target Identification and Social Engineering
  Lazarus Group targets professionals in defense, aerospace, and related sectors using convincing recruiter communications and fake employment opportunities associated with Operation Dream Job.
• Phase 2: Malicious Lure and Initial Execution
  Victims are encouraged to open malicious PDF files or install a fake PDF viewer. In one infection path, DLL side-loading involving libmupdf.dll displays a fake job description while covertly downloading and executing the MISTPEN downloader.
• Phase 3: Reconnaissance and Malware Deployment
  MISTPEN collects system information, enumerates processes, captures screenshots, and communicates through services such as Microsoft Graph API and OneDrive. A parallel attack path uses the trojanized SecurityPDF application to deploy the Troy backdoor.
• Phase 4: Windows Zero-Day Exploitation and Privilege Escalation
  Lazarus exploits CVE-2026-68820 in the Windows AFD.sys driver to achieve SYSTEM-level privileges. The elevated access enables deployment of the FudModule kernel-mode rootkit and further evasion of Windows security controls.
• Phase 5: Command-and-Control and Compromised Infrastructure
  Troy provides remote-access capabilities including file operations, data collection, shell access, process control, and in-memory DLL injection. Lazarus also abuses compromised WordPress, SharePoint, and vulnerable Roundcube servers to support command-and-control operations.
• Phase 6: Post-Compromise Operations and Espionage
  With persistent access established, the attackers can conduct additional reconnaissance, collect sensitive information, move toward higher-value systems, and exfiltrate data as part of the broader cyber-espionage campaign.

Indicators of Compromise (IOCs)

Malicious / Impersonation Domains

envell[.]xyz
enveil[.]online
uxtramine[.]org

These domains were reported as part of websites used to impersonate Enveil and distribute the trojanized SecurityPDF application. Organizations should treat unexpected downloads originating from these domains as suspicious and investigate any historical connections to them.

MITRE ATTACK Mapping

Technique ID	Technique Name	Tactic
T1204.002	User Execution: Malicious File	Execution
T1566	Phishing	Initial Access
T1574.002	DLL Side-Loading	Defense Evasion
T1068	Exploitation for Privilege Escalation	Privilege Escalation
T1055	Process Injection	Defense Evasion
T1057	Process Discovery	Discovery
T1113	Screen Capture	Collection
T1105	Ingress Tool Transfer	Command and Control

Visual Attack Flow

Mitigation

1. Patch CVE-2026-68820 immediately.
   Install Microsoft's August 2026 security updates using Windows Update, WSUS, Configuration Manager, or an approved patch-management solution. Prioritize critical and internet-facing systems.
2. Use trusted software sources.
   Download applications only from official vendor websites and avoid software links received through unsolicited recruiter or job-related messages.
3. Strengthen social-engineering defenses.
   Train employees to identify fake recruiters, malicious PDFs, and suspicious requests to install software during hiring processes.
4. Monitor privilege escalation.
   Use EDR to detect suspicious SYSTEM-level processes, DLL side-loading, process injection, and unauthorized security-control changes.
5. Hunt for IOCs.
   Search DNS, proxy, firewall, and endpoint logs for envell[.]xyz, enveil[.]online, uxtramine[.]org, and related malware activity.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.