North Korea's Lazarus Group Used a Secret Windows Flaw to Break Into Defence Companies

Key points

• Lazarus Group, a hacking operation linked to North Korea, exploited a newly discovered Windows zero-day (a software flaw unknown to the maker at the time) tracked as CVE-2026-68820 to gain full system control over targeted machines.
• The campaign, active since early 2026, targeted defence, aerospace, and aviation organisations in France, Germany, Brazil, and India.
• Microsoft patched the flaw on 12 August 2026 as part of its regular monthly security update, known as Patch Tuesday.
• The US government's cybersecurity agency, CISA (Cybersecurity and Infrastructure Security Agency), ordered federal agencies to apply the fix within two weeks.
• Check Point, the cybersecurity firm that uncovered the campaign, found two separate methods used to deliver malicious software to victims.

Lazarus Group is about as well-documented as criminal hacking operations get. Running since at least 2009 and widely attributed to North Korean state intelligence, the group has stolen billions of dollars and broken into governments, banks, and defence contractors on every inhabited continent.

How did the hackers get in?

They knocked on the front door, disguised as recruiters. Lazarus operatives contacted workers at aerospace and aviation companies through professional networking platforms and direct-messaging apps, offering what looked like attractive job opportunities at well-known firms.

This is a continuation of what researchers call Operation Dream Job, a campaign that has run in various forms for years. The lure is simple: a job seeker downloads what appears to be a PDF document describing a role. Behind the scenes, something very different runs.

Check Point found two distinct attack paths. In the first, the download is a compressed file containing a seemingly legitimate PDF viewer alongside hidden malicious code. When the victim opens a decoy job description, the malicious code runs quietly in the background, loading a piece of software called Mistpen onto the machine without saving any file to disk, making it harder for security tools to spot.

In the second path, victims are pointed toward a booby-trapped version of a PDF viewer called SecurityPDF. Open any PDF with it and the software checks for a hidden signal inside the file. If found, it silently installs a new backdoor called Troy directly in the computer's memory. Troy supports 17 commands its operators can issue remotely: copying files, downloading or uploading data, running shell commands (typed instructions that control the operating system), and more.

What made this attack unusually dangerous?

Both paths eventually exploited CVE-2026-68820, a flaw in a low-level Windows networking component called the Ancillary Function Driver for WinSock (afd.sys). The bug is a use-after-free vulnerability, meaning the software tries to access a piece of memory it has already released, creating an opening attackers can time precisely to trigger a race condition and grant themselves the highest possible level of control over the machine: System privileges. That is the operating system's own level of access.

With that level of access, an attacker can do essentially anything: disable security software, copy every file on the drive, or sit quietly and watch for months.

Microsoft issued a fix on 12 August 2026 as part of its monthly Patch Tuesday security release. CISA added the flaw to its Known Exploited Vulnerabilities catalogue the same day, a designation that tells US federal agencies they have two weeks to patch.

The command infrastructure the group used to receive stolen data also leaned on compromised Roundcube webmail servers and content-management systems, many of them vulnerable to CVE-2025-49113, a remote code execution flaw that allowed attackers to run their own code on those servers. Check Point found a previously undocumented piece of software on those servers called RelayShell, which acted as a quiet relay station, passing instructions back and forth between the hackers and infected machines through plain text files, a method designed to blend in with normal web traffic.

Should workers at defence or aerospace companies be worried?

Yes, and one step matters most right now: apply the August Patch Tuesday update if you or your IT team has not done so.

Beyond that, the recruitment lure is the part that ordinary employees can act on directly. If someone contacts you out of the blue on LinkedIn or a messaging app with a job offer and asks you to download a file, treat that file the way you would treat an unverified email attachment: with real suspicion. Legitimate recruiters do not need you to install a custom PDF viewer to read a job description.

Check Point's full indicators of compromise (specific file signatures and network addresses that identify the attack) are available to security teams reviewing their systems.