Lazarus Group Exploited Windows Kernel Zero-Day via Fake Job Offers Before Microsoft's August Patch Tuesday Fix

Overview

A North Korea-linked hacking group exploited a zero-day flaw in a core Windows kernel driver for weeks before Microsoft shipped a fix, using fraudulent job offers to break into defense contractors and deploy an updated version of a kernel-mode rootkit, according to Check Point Research. Microsoft patched the vulnerability, tracked as CVE-2026-68820, as part of its August 2026 Patch Tuesday release on August 11, according to BleepingComputer.

What We Know

The flaw sits in the Windows Ancillary Function Driver for WinSock, known as AFD.sys, the kernel-mode driver that manages socket handling for the Windows Sockets API. Check Point researchers found that “two of its own code paths can operate on this state at the same simultaneously, without synchronization, creating a race condition,” and that when triggered correctly, “one code path can access memory after it has already been released by another, resulting in a use-after-free vulnerability,” according to Check Point Research. Successful exploitation gives an attacker a kernel read/write primitive that can be used to escalate to SYSTEM-level privileges.

Microsoft’s own advisory language describes the bug similarly: “A locally authenticated attacker could run a specially crafted application on an affected system to trigger a race condition. Successful exploitation could allow the attacker to gain SYSTEM privileges,” according to SecurityWeek. The vulnerability carries a CVSS score of 7.0, according to Tenable and CrowdStrike.

Check Point reported the flaw to the Microsoft Security Response Center on July 28, 2026; Microsoft confirmed the issue on July 31, formally assigned CVE-2026-68820 on August 5, and shipped a patch on August 11 as part of Patch Tuesday, according to Check Point Research. BleepingComputer reported that researchers documented exploitation beginning in early July 2026 — meaning the bug was already being used in the wild before Check Point’s disclosure to Microsoft.

Check Point attributed the exploitation to the Lazarus Group, a hacking operation linked to North Korea, as part of its long-running “Operation Dream Job” campaign. The campaign’s initial access method relies on fraudulent job postings on professional networking sites; Check Point found that “the threat actor distributed modified PDF viewers designed to execute malicious payloads embedded within specially crafted PDF files” through impersonation websites tied to those fake job offers, according to Check Point Research. Help Net Security similarly reported that the vulnerability “has been exploited by North Korean attackers to deploy a kernel-mode rootkit in a new wave of the Operation Dream Job campaign.”

The victims were concentrated in the defense sector. Check Point identified targets among defense contractors specializing in surveillance sensors, drones, and robotics across Brazil, France, Germany, and India, according to Check Point Research. BleepingComputer reported the same wave hit “defense, aerospace, and aviation organizations in Europe and India, using fraudulent recruitment offers,” with confirmed targeting extending to “South America, including Brazil, and successful targeting observed in Western Europe, including France and Germany.” One compromised French organization was subsequently used as a staging point for spear-phishing campaigns against additional targets worldwide, which Check Point said helped the attackers’ messages appear more legitimate.

Once attackers achieved SYSTEM privileges through the AFD.sys exploit, they deployed an updated build of FudModule, a kernel-mode rootkit Lazarus has used and refined across several prior campaigns. Check Point said this variant “exclusively targets Windows 11 builds 26100 (24H2) and 26200 (25H2),” dropping support for older Windows versions, and added a new capability that tampers with Windows Smart App Control by setting the VerifiedAndReputablePolicyState registry value to zero and forcing a code-integrity policy reload, according to Check Point Research. The rootkit disabled 94 Event Tracing for Windows provider GUIDs matching known kill-lists, suppressed Microsoft Defender monitoring, removed security minifilters, and terminated the NT Kernel Logger, according to the same report. BleepingComputer similarly described the updated rootkit as disabling “EDR telemetry and interfering with security products,” alongside the new Smart App Control tampering functionality.

CVE-2026-68820 was one of three publicly disclosed or exploited flaws Microsoft addressed in its August Patch Tuesday release. The company also fixed CVE-2026-62832, an elevation-of-privilege flaw in the Windows User Profile Service that security researchers had previously documented as “LegacyHive.” The flaw involves “improper link resolution before file access” that could let an authenticated attacker “access or modify another user’s data and gain administrator privileges,” according to BleepingComputer. A third flaw, CVE-2026-72971, affects the Windows Container Isolation FS Filter Driver (unionfs.sys) and similarly stems from “link following,” according to SecurityWeek. Overall, Help Net Security described the release as addressing “400+ vulnerabilities, including one that has been exploited in zero-day attacks.”

What We Don’t Know

Check Point’s report does not specify exactly how many organizations were successfully compromised in this wave, nor does it give a precise date on which exploitation first began — BleepingComputer’s sourcing places it only at “early July 2026.” Security outlets covering the broader Patch Tuesday release also disagree on the exact total vulnerability count, with figures ranging from the high 300s to the low 400s depending on the vendor’s counting methodology, an inconsistency that has not been reconciled against Microsoft’s own advisory data.

Analysis

The combination of a kernel zero-day and a rootkit purpose-built to blind Windows’ own telemetry reflects a pattern Lazarus has repeated across multiple campaigns: gain initial access through social-engineering lures aimed at defense- and aerospace-sector employees, then use a fresh kernel exploit to install FudModule before endpoint detection tools can flag the activity. The decision to scope the newest FudModule build specifically to current Windows 11 builds — while dropping compatibility with older versions — suggests the group is investing in exploits tuned to the exact software configurations used by its intended targets rather than broad, indiscriminate deployment.