North Korea's Lazarus Group Used a Secret Windows Flaw to Break Into Defence Companies

Key points

• Lazarus Group, a hacking operation linked to North Korea, exploited a newly discovered Windows zero-day (a software flaw unknown to the maker at the time) tracked as CVE-2026-68820 to gain full system control over targeted machines.
• The campaign, active since early 2026, targeted defence, aerospace, and aviation organisations in France, Germany, Brazil, and India.
• Microsoft patched the flaw on 11 August 2026 as part of its regular monthly security update, known as Patch Tuesday.
• CISA (Cybersecurity and Infrastructure Security Agency), the US government's cybersecurity agency, ordered federal agencies to apply the fix within two weeks.
• Check Point, the cybersecurity firm that uncovered the campaign, found two separate methods used to deliver malicious software to victims.

Lazarus Group is about as well-documented as criminal hacking operations get. Running since at least 2009 and widely attributed to North Korean state intelligence, the group has stolen billions of dollars and broken into governments and defence contractors on every inhabited continent.

How did the hackers get in?

They knocked on the front door, disguised as recruiters. Lazarus operatives contacted workers at aerospace and aviation companies through professional networking platforms and direct-messaging apps, offering what looked like attractive job opportunities at well-known firms.

This is a continuation of what researchers call Operation Dream Job, a campaign that has run in various forms for years. The lure is simple: a job seeker downloads what appears to be a PDF document describing a role. Behind the scenes, something very different runs.

Check Point found two distinct attack paths. In the first, the download is a compressed file containing a seemingly legitimate PDF viewer alongside hidden malicious code. When the victim opens a decoy job description, the malicious code runs quietly in the background, loading a piece of software called Mistpen onto the machine without saving any file to disk, making it harder for security tools to spot. That chain continues with reconnaissance, persistence, and then the zero-day exploit, ultimately deploying ForestTiger, a known Lazarus backdoor.

In the second path, victims are pointed toward a booby-trapped version of a PDF viewer called SecurityPDF. Open any PDF with it and the software checks for a hidden signal inside the file. If found, it installs a new backdoor called Troy directly in the computer's memory. Troy supports 17 commands its operators can issue remotely: file enumeration, data exfiltration, shell commands (typed instructions that control the operating system) and DLL injection.

What made this attack unusually dangerous?

Both paths eventually exploited CVE-2026-68820, a flaw in a low-level Windows networking component called the Ancillary Function Driver for WinSock (afd.sys). The bug is a use-after-free vulnerability, meaning the software tries to access a piece of memory it has already released, creating an opening attackers can time precisely to trigger a race condition and grant themselves the highest possible level of control: System privileges, the operating system's own level of access.

With that access, an attacker can disable security software, copy every file on the drive, or watch quietly for months. Our story on 11 August, "Microsoft's August Patch Tuesday: 400 fixes, three zero-days, and Lazarus back in the frame", reported that North Korean hackers were already using this same afd.sys hole to plant a kernel rootkit before the patch shipped.

Microsoft issued a fix on 11 August 2026 as part of its monthly Patch Tuesday release. CISA added the flaw to its Known Exploited Vulnerabilities catalogue the same day, Check Point reports, a designation that gives US federal agencies two weeks to patch.

The command infrastructure the group used to receive stolen data leaned on compromised Roundcube webmail servers and content-management systems, many vulnerable to CVE-2025-49113, a remote code execution flaw exploited since June 2025. Check Point found a previously undocumented piece of software on those servers called RelayShell, a PHP webshell that acted as a communication relay, passing commands and responses between the hackers and infected machines through plain text files, designed to blend with normal web traffic.

Should workers at defence or aerospace companies be worried?

Yes, and one step matters most right now: apply the August Patch Tuesday update if you or your IT team hasn't done so.

Beyond that, the recruitment lure is the part ordinary employees can act on directly. If someone contacts you out of the blue on LinkedIn or a messaging app with a job offer and asks you to download a file, treat that file the way you'd treat an unverified email attachment. Legitimate recruiters don't need you to install a custom PDF viewer to read a job description.

Check Point's full indicators of compromise (specific file signatures and network addresses that identify the attack) are available to security teams reviewing their systems.