The North Korean state-sponsored hacking collective, known as the Lazarus Group, has been identified exploiting a recently patched zero-day vulnerability in Microsoft Windows to infiltrate defense and aerospace sectors across multiple countries, including France, Germany, Brazil, and India. This campaign is part of their ongoing ‘Operation Dream Job,’ which employs sophisticated social engineering tactics to compromise targeted systems.
Operation Dream Job involves the Lazarus Group masquerading as recruiters on professional networking platforms like LinkedIn. They approach individuals with enticing but fraudulent job offers from reputable companies such as Lockheed Martin and Enveil. The objective is to build trust and persuade targets to open malicious documents or install compromised software, thereby facilitating unauthorized access to sensitive information.
The specific vulnerability exploited in these attacks is identified as CVE-2026-68820, a privilege escalation flaw within the Windows Ancillary Function Driver for WinSock (AFD.sys). Microsoft addressed this security issue in its August 2026 Patch Tuesday updates. By leveraging this flaw, attackers can gain elevated privileges on compromised systems, enabling them to execute arbitrary code and deploy malware.
Infection Vectors and Malware Deployment
The Lazarus Group employs two primary methods to deliver malware to their targets:
- DLL Side-Loading Technique: Victims receive an encrypted archive containing a malicious DLL named ‘libmupdf.dll.’ When executed, this DLL displays a decoy job description while covertly downloading and running a lightweight downloader called MISTPEN. MISTPEN communicates with attacker-controlled infrastructure via Microsoft Graph API and OneDrive to retrieve additional modules. These modules perform reconnaissance, establish persistence, and exploit the AFD.sys driver vulnerability to deploy a backdoor known as ForestTiger (also referred to as ScoringMathTea), granting remote access to the compromised system.
- Trojanized PDF Viewer: Targets are directed to download a compromised PDF viewer named ‘SecurityPDF’ from a website impersonating Enveil. Once installed, this application monitors for PDFs containing a specific marker. Upon detecting such a document, it decrypts and executes an embedded payload that loads a backdoor called Troy directly into memory. Troy supports various commands, including file operations, process management, and in-memory DLL injection, facilitating extensive control over the infected machine.
These methods underscore the Lazarus Group’s adaptability and technical proficiency in executing complex cyber-espionage operations. By exploiting zero-day vulnerabilities and employing advanced social engineering techniques, they effectively bypass traditional security measures, posing significant threats to targeted organizations.
Organizations, particularly those in the defense and aerospace sectors, must remain vigilant against such sophisticated attacks. Implementing robust security protocols, conducting regular system updates, and educating employees about social engineering tactics are crucial steps in mitigating the risks associated with these advanced persistent threats.
