Lazarus Exploits Zero-Day in Windows Driver and Installs Rootkit in Defense and Aerospace Attacks

On Tuesday, August 11, Microsoft patched a vulnerability in the AFD.sys driver of Windows that North Korea-linked operators had been actively exploiting to install a rootkit on compromised machines. The vulnerability was assigned the identifier CVE-2026-68820, with a CVSS score of 7.0 and marked as important, but the scope of the campaign surrounding it warrants greater attention than the rating suggests.

AFD.sys, or the Ancillary Function Driver for WinSock, is a kernel-mode component that serves as the backbone of the Windows socket API. The flaw is of the use-after-free type and relies on triggering a race condition in the driver. Once exploited locally, it allows an attacker with execution on the machine to elevate privileges to SYSTEM without any user interaction.

FudModule v3.1: What Comes After Escalation

What changes the reading is the payload delivered following the escalation. According to researchers from Check Point, who responsibly disclosed the issue to the vendor, the installed binary is FudModule v3.1, Lazarus's signature for kernel mode. The new version removes telemetry callbacks, disables minifilters, terminates the NT Kernel Logger, and blinds over 90 ETW providers. Teams that rely on Windows' native audit trails for threat hunting are left with virtually no visibility on already compromised endpoints.

Detecting FudModule by its behavior has become more difficult precisely because version 3.1 was designed to disable the telemetry sources on which typical EDRs rely. The minimum recommendation is to immediately apply the patch released on Tuesday to exposed servers and engineering workstations, and to review ETW event captures in sampling to identify anomalous drops in volume that may indicate compromise prior to disclosure.

Operation Dream Job: Geographic Reach

The exploitation is part of what is called Operation Dream Job, a espionage campaign that Check Point has been tracking since the beginning of 2026 and that targets defense, aerospace, and aviation sectors. Confirmed activity has been observed in Europe, India, and Brazil, among other regions. The pattern is familiar: approach via LinkedIn with fake job offers for engineers and researchers, followed by contaminated attachments that serve as a foothold for the rootkit.

In India, the direct target usually is the domestic defense industrial base and the engineering centers outsourced by Western primes, two vectors that have gained momentum in recent years with the Make in India program. In Brazil, the mention is operational, not geopolitical: local suppliers in the aerospace and defense supply chains often integrate into international consortia with European and Indian counterparts, and it is this intersection that the group tends to exploit. Embraer, Atech, and IMBEL did not respond to requests for comment on exposure to this specific campaign by the time this article was published.

The Patch Tuesday Surrounding the Vulnerability

In addition to CVE-2026-68820, the August patch package included fixes for around 398 vulnerabilities, three of which are zero-days according to Microsoft's count. The other two have not yet been publicly linked to active exploitation. The cycle includes critical severity remote code execution bugs, among them CVE-2026-62893 in the TFTP service of Windows Deployment Services (CVSS 9.8) and CVE-2026-55040 in SharePoint Server Subscription Edition, 2019, and 2016 (CVSS 9.1). Neither was observed being exploited until this morning, but both pave the way for remote code execution without authentication in environments that many teams still keep exposed internally.

The usual priority order of addressing critical RCEs first needs to be inverted here. An RCE with no known exploitation enters the normal cycle. A kernel zero-day already being used by a state group against defense and aviation targets, with a rootkit designed to blind EDR, holds a different classification. For CISOs of consultancies serving these sectors across multiple geographies, CVE-2026-68820 belongs in the incident queue, not the patch queue.

Microsoft has not publicly linked specific victims to the exploitation, and Check Point has adhered to the standard practice of not naming clients. What is on record is the attribution to Lazarus, the rootkit, and the list of affected sectors. For security consultancies conducting hunts in multinational environments, this is the trigger to review telemetry from the past 60 days instead of waiting for the next bulletin.