Tia N.List

CTI · reviewed · 2026-08-14

Windows AFD.sys Zero-Day Exploited by Lazarus Hackers to Gain SYSTEM Access

Full story & timeline

Actors

Lazarus

Malware / tools

SecurityPDFTroyMISTPENFudModuleRelayShell

Campaigns

Operation Dream Job

CVEs

CVE-2025-49113CVE-2026-68820

Victim sectors

DefenseAerospaceAviation

Geography

EuropeIndia

MITRE ATT&CK

Indicators

Observables tied to this case, from the curated feed. raw sidecar

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Trojanized SecurityPDF Viewer Execution
id: 4a3d2f7e-9b1c-4e5a-8f2d-6c1b0a9e3d5f
status: experimental
description: >
    Detects execution of SecurityPDF.exe, a trojanized MuPDF-based PDF
    viewer distributed in the July 2026 Operation Dream Job wave attributed
    to the DPRK-linked Lazarus group (Check Point Research). The modified
    viewer is designed to open attacker-crafted PDF documents and execute an
    embedded payload, deploying the previously undocumented Troy backdoor and
    leading to CVE-2026-68820 (AFD.sys) local privilege escalation and
    FudModule kernel-mode rootkit deployment. The campaign targets the
    defense sector, with a focus on Europe and India, via fake job offers
    delivered over LinkedIn or direct messaging.
references:
    - https://malware.news/t/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/124701#post_1
    - https://www.bleepingcomputer.com/news/security/lazarus-hackers-exploited-windows-zero-day-to-target-defense-firms/
    - https://cyberpress.org/hackers-weaponize-job-offers-with-zero-day-exploit/
    - https://gbhackers.com/windows-afd-sys-zero-day-exploited-by-lazarus-hackers/
author: Tia N. List
date: 2026/08/14
tags:
    - attack.t1204
logsource:
    category: process_creation
    product: windows
detection:
    selection_viewer:
        Image|endswith: '\SecurityPDF.exe'
    condition: selection_viewer
falsepositives:
    - Legitimate software coincidentally named SecurityPDF.exe; corroborate with PDF-processing child processes or subsequent privilege-escalation behavior
level: high

Splunk SPL raw

# windows-afd-sys-zero-day-exploited-by-lazarus-hackers-to-gain-sy — Splunk SPL variant (derived from windows-afd-sys-zero-day-exploited-by-lazarus-hackers-to-gain-sy.sigma via sigma convert)
# source-sha256: 234ee721bbb69f4f2bc75374f5eb1942df25d6cc03de16c1134897ffc4a127cd v1
Image="*\\SecurityPDF.exe"

KQL (Sentinel / Defender) raw

# windows-afd-sys-zero-day-exploited-by-lazarus-hackers-to-gain-sy — KQL variant (derived from windows-afd-sys-zero-day-exploited-by-lazarus-hackers-to-gain-sy.sigma via sigma convert)
# source-sha256: 234ee721bbb69f4f2bc75374f5eb1942df25d6cc03de16c1134897ffc4a127cd v1
Image endswith "\\SecurityPDF.exe"

References

Source on GitHub