A fake job offer ended with a rootkit in the Windows kernel

On 11 August 2026, Check Point Research published an analysis of a new wave in the Operation Dream Job campaign, which the company attributes to the North Korean group Lazarus. The wave has been running since early 2026 against the defence sector, with particular emphasis on companies in aerospace and aviation, and its latest part targets the defence sector in Europe and India. During the intrusion the actor exploited a zero-day vulnerability in the Windows AFD.sys driver in order to run the FudModule rootkit with SYSTEM privileges and remove EDR visibility. Check Point reported the flaw to Microsoft, which assigned it CVE-2026-68820 and shipped a fix on 11 August 2026. Command traffic ran through hijacked Roundcube and WordPress servers carrying RelayShell, a PHP webshell.

What happens technically

The campaign opens with targeted approaches about positions at well known companies in defence, aerospace and aviation, and Check Point describes two infection chains running in parallel. In the first, the victim downloads an encrypted archive holding a genuine and digitally signed PDF viewer, a malicious DLL named libmupdf.dll and an encrypted payload with a pdf file extension. When the viewer starts, it loads the malicious DLL instead of the genuine one, a technique known as DLL sideloading. The DLL displays a decoy document posing as a Lockheed Martin job description, and at the same time runs the MISTPEN downloader directly in memory. MISTPEN pulls further modules through the Microsoft Graph API from files the attacker keeps on OneDrive, first to profile the machine, then to survive a reboot, then for privilege escalation, and finally the ForestTiger backdoor. Check Point observed the second chain in July 2026, and there the lure is a job offer in the name of the technology company Enveil. The archive contains SecurityPDF, a modified build of an open source PDF viewer based on the MuPDF framework, together with a file that looks like a PDF document. The attacker changed two places in the viewer, both the file open dialogue and the routine that receives files dragged into the window, so that a document carrying a specific marker string makes the viewer extract the payload, decrypt it with a simple XOR key, write it to %TEMP%\new.exe and launch it as a separate process. The file new.exe loads the Troy backdoor, which had not been documented before. Check Point found at least three websites posing as Enveil and distributing the modified viewer, some of them ranking highly in search results and a few of them appearing as the top result. Check Point sees no indication that Enveil itself was targeted or compromised.

The privilege escalation is the core of this case. The module Check Point examined, Afd4Eop12_x64.dll, is a new build of FudModule, a tool Lazarus has used since around 2021. Its target is afd.sys, the part of Windows that manages sockets, the endpoints for network traffic on the machine. The driver keeps a small piece of state for each socket, and under specific concurrent conditions two of its own code paths can act on that state at the same time and without synchronisation. If the attacker hits the right moment, one code path uses memory the other has already released, and NVD describes the flaw as a use after free in the Windows Ancillary Function Driver for WinSock. From there the module obtains read and write access to kernel memory, and uses that to elevate itself to SYSTEM. FudModule then injects a fresh instance of MISTPEN into a SYSTEM process, and Check Point writes that from that point the malware keeps running without EDR seeing it. The sample requires the machine to be running at least Windows 11 build 26100, and it carries explicit support for build 26200 as well. Check Point writes that the flaw has been exploited in attacks since at least early July 2026. Check Point reported the issue to Microsoft on 28 July, Microsoft confirmed it on 31 July, assigned CVE-2026-68820 on 5 August and released the fix on 11 August. NVD scores the vulnerability 7.0 and rates it high, with a local attack vector and high attack complexity, and Microsoft's release note for August flags it as exploited. Check Point is holding back the full technical detail now that the flaw is fixed.

The command infrastructure is built from other people's servers. Check Point writes that Lazarus exploited CVE-2025-49113 to take over Roundcube servers, the webmail that organisations run themselves. That vulnerability was published in June 2025, affects Roundcube before 1.5.10 and 1.6.x before 1.6.11, and lets an authenticated user execute code because the _from parameter in a URL is not validated before it is deserialised. NVD scores it 9.9 and rates it critical. On those hijacked Roundcube servers and on hijacked WordPress servers the attacker planted RelayShell, a PHP webshell that turns the server into a relay node inside the attacker's own command network. Traffic from an infected machine therefore lands on a host whose name and reputation look legitimate. In at least one case a compromised organisation in Western Europe was used to send further spear-phishing, letting the attacker borrow that organisation's reputation to reach new victims.

What this means for you if you secure a defence company

If you carry the security responsibility in a company that supplies the defence sector, look closely at where this attack begins. It does not begin in your infrastructure. It begins with an engineer who receives a friendly message about an interesting position. Our assessment is that recruitment is the hardest channel to control, because it is personal, it is flattering, and it happens in channels the organisation does not own. Check Point also describes the actor standing up websites in a vendor's name, some of which ranked highly in search results. Telling people not to open attachments no longer covers it, because the file is fetched from what the user believes is the vendor's own site.

The second thing to take away is what the zero-day did to your visibility. Once the attacker holds SYSTEM and loads a rootkit into the kernel, the EDR agent on that machine is no longer a witness you can trust. Our assessment is that this is precisely the argument for shipping security logs off the endpoint as they are produced, and for not resting detection on a single product. The vulnerability itself is fixed, and a machine that has taken Microsoft's August update is no longer exposed to this particular flaw. If you run Roundcube or WordPress yourself, you also have a part in this story without being a target, because a server left standing with an old vulnerability can end up as a relay in somebody else's attack.

Berigo recommends

• Install Microsoft's August update on every Windows 11 machine, and take the machines used by engineers and project managers on defence work first.
• Upgrade Roundcube to 1.5.10 or 1.6.11 or later, and review your own WordPress installations for unfamiliar PHP files.
• Ship security logs off the endpoint continuously, so that evidence survives even when the agent on the machine is disabled.
• Put fake recruitment approaches into your security training, and give staff somewhere to report them without being made to feel foolish.
• Look for PDF viewers installed outside your standard software portfolio, and for applications launching executables from %TEMP%.