Reported by 11 outlets
Windows AFD.sys Zero-Day Exploited by Lazarus Hackers to Gain SYSTEM Access
Why this score
- Breadth
- 2.00 / 2.0 · 11 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.22 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Lazarus exploited CVE-2026-68820, a use-after-free in the Windows AFD.sys driver (CVSS 7.0), to escalate from a local foothold to SYSTEM privileges and deploy FudModule v3.1, a kernel-mode rootkit that disables EDR visibility through process, thread, and image notify callbacks and suppresses crash dumps before anything else. The vulnerability requires concurrent thread interaction with socket state and was actively exploited since at least early July 2026 against Windows 11 builds 26100 (24H2) and 26200 (25H2), with Check Point disclosing the issue to Microsoft on July 28, 2026, and Microsoft assigning CVE-2026-68820 on August 5 before patching it in the August 11, 2026 Patch Tuesday release. The infection chain relies on SecurityPDF, a trojanized MuPDF-based viewer that checks for the marker "This document is encrypted with sumatrapdf reader!!!!!!!!!!!!!!!", decrypts an embedded payload with a single-byte XOR key (0x39), writes it to %TEMP%\new.exe, and launches it; the resulting payload is Troy, a previously undocumented 64-bit DLL backdoor with 17 operator commands that connects to three configured C2 servers over port 80 and validates responses against the string CONNECTED.
A successful compromise turns a defense-sector endpoint into a persistent, kernel-controlled relay node: FudModule injects into a SYSTEM msiexec.exe process through a two-hop spawn via services.exe, forgery of privileged handles, and execution of a remote DLL, while the attacker also deploys MISTPEN, an in-memory downloader that uses the Microsoft Graph API to retrieve AES-encrypted payloads from attacker-controlled OneDrive folders. The campaign specifically targets aerospace, aviation, and military technology firms in Europe and India, using fake recruitment lures and impersonated websites (Enveil-themed pages ranking as top search results) to separate PDF delivery from viewer download and evade detection. At least one compromised Western European organization was repurposed for spear-phishing additional targets, and at least 17 unique RelayShell session identifiers indicate a broad relay infrastructure hosted on compromised Roundcube webmail servers vulnerable to CVE-2025-49113 (CVSS 9.9), which the attackers exploit with leaked dark-web credentials to deploy RelayShell and turn legitimate web infrastructure into bidirectional command channels.
Defenders should apply the August 2026 Microsoft patch immediately for CVE-2026-68820 and upgrade Roundcube to 1.6.11 or 1.5.10 to close CVE-2025-49113. Hunt for the SecurityPDF viewer binary (hashes including 743172aab606974b054a64561534ae66baa3a840657f79d7c6fa18350e8d45d1) and the Troy PDB path E:\HK\Tool_Module\Troy_Handle; inspect %TEMP%\new.exe executions, monitor Microsoft Graph API traffic from unusual processes for MISTPEN behavior, and review AFD.sys race-condition telemetry for abnormal concurrent socket access leading to memory corruption. Network restrictions should block outbound connections to the identified C2 IP ranges (135.181.67.203, 135.181.185.158) and inspect for RelayShell session files named with the convention 1.log and 2.log on any web server running vulnerable Roundcube instances.
The assessment changes if Microsoft releases an out-of-band update that expands the AFD.sys fix beyond builds 26100 and 26200, or if Check Point or another researcher documents additional FudModule variants targeting older Windows releases; a second shift would occur if new telemetry confirms RelayShell deployment on non-Roundcube CMS servers (PrestaShop instances were also observed), which would expand the exposure footprint beyond mail infrastructure. Watch for updates to the CISA KEV entry for CVE-2026-68820 and any new IOCs tied to the 17 observed RelayShell identifiers or additional Enveil impersonation domains.
Timeline
-
original reporting
Windows AFD.sys Zero-Day Exploited by Lazarus Hackers to Gain SYSTEM Access
gbhackers.com · 62d ago · August 12th, 2026
Lazarus has expanded its long-running Operation Dream Job campaign by exploiting a Windows zero-day vulnerability that grants attackers SYSTEM-level access and helps neutralize endpoint visibility. This DPRK-linked threat actor is specifically targeting defense, aerospace, and aviation organizations worldwide, with recent activity impacting entities in Europe and India. Check Point Research identified the flaw as CVE-2026-68820, […] The post Windows AFD.sys Zero-Day Exploited by Lazarus Hackers to Gain SYSTEM Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from roundcube.net
Roundcube security updates 1.6.11 and 1.5.10 advisory
roundcube.net · 500d ago · June 1st, 2025
Roundcube released security updates 1.6.11 and 1.5.10 on June 1, 2025, patching the deserialization vulnerability later tracked as CVE-2025-49113. The advisory confirms the RCE risk for authenticated users and provides the commit references that fix improper input validation in program/actions/settings/upload.php.
-
update from cve.org
CVE-2025-49113 - Roundcube Webmail RCE (CVE.org record)
cve.org · 499d ago · June 2nd, 2025
MITRE published the CVE record on June 2, 2025, for an authenticated PHP object deserialization vulnerability in Roundcube Webmail (before 1.5.10 and 1.6.x before 1.6.11). The flaw allows remote code execution via the _from parameter. It carries a CVSS 3.1 score of 9.9 (Critical) and was later exploited by Lazarus in the 2026 campaign to deploy RelayShell webshells on compromised mail servers.
-
update from welivesecurity.com
Gotta fly: Lazarus targets the UAV sector (ESET Research)
welivesecurity.com · 356d ago · October 23rd, 2025
ESET documented an Operation Dream Job wave targeting European defense and UAV-sector companies with trojanized PDF readers and ScoringMathTea. The attackers used social engineering via fake job offers, DLL sideloading, and a new loader (BinMergeLoader) to deliver the payload. The campaign aligns with North Korea's drone program expansion and reverse-engineering efforts, making it a precursor to the 2026 zero-day exploitation.
-
update from malware.news
Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack
malware.news · 63d ago · August 11th, 2026
In the latest variant of the Operation Dream Job campaign, the threat actor distributed SecurityPDF , a modified PDF viewer designed to open attacker-crafted PDF documents and execute a new backdoor which we named Troy . During the intrusion, the threat actor exploited CVE-2026-68820 , a zero-day vulnerability in the Microsoft AFD.sys driver, to deploy a new version of FudModule , Lazarus’ kernel-mode rootkit. Following Check Point Research responsible disclosure, Microsoft released a patch as part of their August Patch Tuesday updates. The compromised servers were infected with RelayShell , a PHP webshell that repurposes compromised web servers as relay nodes within the attacker’s command-and-control infrastructure. At least in one case, a compromised organization in Western Europe was leveraged to conduct a spear-phishi
-
update from cyberpress.org
Hackers Weaponize Job Offers With Zero-Day Exploit to Gain Silent System Access
cyberpress.org · 62d ago · August 12th, 2026
A new wave of the DPRK-linked Lazarus group’s long-running Operation Dream Job is revealing that the campaign now exploits a previously unknown Windows kernel vulnerability to seize full system control while evading endpoint detection entirely. According to Check Point, the campaign, active since early 2026, primarily targets the global defense sector, with a sharp focus on aerospace, aviation, and military technology firms in Europe and India. Posing as recruiters likely via LinkedIn or direct messaging, the attackers lure victims with fake job offers from well-known companies, ultimately directing them to download malicious files. Hackers Weaponize Job Offers With Zero-Day Exploit Check Point identified two parallel infection chains. The first uses DLL sideloading: a signed PDF viewer loads a malicious DLL that decrypts and runs MISTPEN, a lightweight in-memory downloader that abuses the Microsoft Graph API to fetch modules from OneDrive. The second, newer chain distributes SecurityPDF, a trojanized MuPDF-based PDF viewer impersonating the privacy-tech firm Enveil. When a victim opens a specially crafted PDF, the app checks for a hidden marker, decrypts an embedded payload with a single-byte XOR key, and ultimately launches it, deploying a previously undocumented backdoor named Troy. Windows AFD.sys Zero-Day Attack Chain (Source : CheckPoint) The most alarming discovery is a zero-day local privilege escalation flaw in Microsoft’s AFD.sys driver, which manages Windows socket
-
mentioned by securityweek.com
Fresh Windows Zero-Day Exploited in North Korean Cyberattacks
securityweek.com · 62d ago · August 12th, 2026
-
update from socprime.com
CVE-2026-68820: Actively Exploited Windows AFD.sys Zero-Day Enables SYSTEM Privilege Escalation
socprime.com · 62d ago · August 12th, 2026
Microsoft’s August 2026 Patch Tuesday addresses hundreds of security vulnerabilities, but one issue stands out because attackers were already exploiting it before a fix became available. CVE-2026-68820 is a high-severity elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock, or AFD.sys, that can allow a local attacker to escalate privileges to SYSTEM. Although exploitation requires an attacker to already have code running on the target machine, successful abuse effectively turns an existing foothold into full system-level control without requiring additional user interaction. The vulnerability has also been linked to real-world nation-state activity. CVE-2026-68820 analysis At a technical level, CVE-2026-68820 is a use-after-free vulnerability in AFD.sys caused by improper synchronization when multiple threads interact with socket-related state concurrently. Under specific race conditions, one code path can free a memory object while another continues to access it, creating a memory corruption condition t
-
update from bleepingcomputer.com
Lazarus hackers exploited Windows zero-day to target defense firms
bleepingcomputer.com · 62d ago · August 12th, 2026
Microsoft addressed the flaw in this month's Patch Tuesday security updates , marking it as actively exploited in the wild . Researchers found that the Lazarus threat group has been leveraging it since early July. The tech giant added that a locally authenticated user could run a specially crafted application on an affected system to trigger a race condition, eventually gaining SYSTEM privileges without any user interaction.
-
mentioned by gbhackers.com
CISA Adds Actively Exploited Windows WinSock Vulnerability to KEV Catalog
gbhackers.com · 61d ago · August 13th, 2026
-
mentioned by cybersecurefox.com
CVE-2026-68820: zero-day in afd.sys exploited in attacks 🔗 https:// cybersecurefox.com/en/cve-2026 -68820-use-after-free-windows-afd-winsock
cybersecurefox.com · 25d ago · September 18th, 2026