Answer Brief
Lazarus Group exploited CVE-2026-68820, a Windows AFD.sys privilege escalation flaw, to deploy the Troy backdoor via trojanized PDF viewers and DLL side-loading, targeting defense and aerospace sectors globally using compromised legitimate infrastructure for C2.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
Check Point Research observed successful exploitation of CVE-2026-68820
- 2
Check Point Research reported CVE-2026-68820 to Microsoft
- 3
Microsoft patched CVE-2026-68820 as part of Patch Tuesday
- 4
The Hacker News published details of Lazarus Group's exploitation of the zero-day
Executive Summary: Lazarus Group exploited CVE-2026-68820, a Windows AFD.sys privilege escalation flaw, to deploy the Troy backdoor via trojanized PDF viewers and DLL side-loading, targeting defense and aerospace sectors globally using compromised legitimate infrastructure for C2.
Why It Matters
Lazarus Group’s exploitation of CVE-2026-68820 represents a significant evolution in its Operation Dream Job campaign, combining zero-day privilege escalation with sophisticated social engineering and abuse of trusted infrastructure. The vulnerability in AFD.sys, a core Windows networking component, allowed the group to escalate privileges to SYSTEM level, a critical step for deploying persistent malware without triggering user-account-based alerts. Check Point Research confirmed that the flaw was actively exploited as early as June 2026, before its public patch in August, indicating a narrow but dangerous window of exposure that aligns with Lazarus’s known pattern of zero-day usage in espionage operations. The attack chain begins with reconnaissance via LinkedIn, where threat actors pose as recruiters from legitimate firms like Enveil or Lockheed Martin to build trust with targets in defense and aerospace. Victims are then lured into downloading either a malicious PDF or a trojanized PDF viewer named SecurityPDF, hosted on fake domains mimicking Enveil—envell[.]xyz, enveil[.]online, and uxtramine[.]org. These sites were not only used to distribute malware but also to enhance the credibility of the social engineering lure, exploiting the psychological assumption that top-ranked search results are safe. Once the trojanized viewer is installed, it monitors for a specific marker in opened PDF files. Upon detection, it decrypts and launches the Troy backdoor directly into memory, bypassing traditional file-based detection. Troy’s DLL implant supports 17 commands, enabling file manipulation, exfiltration, interactive shell access, and in-memory DLL injection—capabilities consistent with long-term espionage rather than immediate disruption. The use of memory-only execution reduces forensic footprints and complicates incident response. A second infection vector involves DLL side-loading, where victims download an encrypted archive containing a benign-looking PDF lure (libmupdf.dll) that secretly executes MISTPEN, a lightweight downloader. MISTPEN then communicates with attacker-controlled infrastructure via Microsoft Graph API and OneDrive to retrieve additional modules, including GetInfoPlugin, PvPlugin, OneScreenCapture, and an LPE loader. This loader is notable for integrating post-quantum cryptography—specifically ML-KEM—for key exchange during C2 handshakes, signaling Lazarus’s investment in future-resistant tradecraft. The FudModule 3.1 rootkit, an updated version of a tool Lazarus has used since at least 2022, plays a critical role in defense evasion. By tampering with Windows Smart App Control—setting VerifiedAndReputablePolicyState to zero and invoking NtSetSystemInformation to reload the code integrity policy—the rootkit allows malicious processes to execute despite security policies designed to block untrusted software. This technique enables the attackers to run MISTPEN within a SYSTEM-level msiexec.exe process, effectively hiding it from endpoint detection and response (EDR) tools. Perhaps most operationally significant is Lazarus’s avoidance of bespoke infrastructure. Instead, the group hijacked already-compromised legitimate websites and servers—including WordPress, SharePoint, and Roundcube instances—to host C2 traffic. Many of these Roundcube servers were found vulnerable to CVE-2025-49113, which Lazarus exploited to install RelayShell, a PHP web shell that exchanges commands as text files. In one observed case, a breached French organization was used to launch phishing campaigns against new victims, leveraging its reputation to bypass email filters. This strategy of ‘living in legitimate infrastructure’ drastically increases the difficulty of detection. As Sergey Shykevich of Check Point noted, when the website, download source, and recruiter all appear authentic, traditional phishing awareness training becomes ineffective. Defenders must now assume that trust can be counterfeited and adopt zero-trust principles not only for user behavior but also for software sources and partner networks. For global security teams, the implications are clear: patch management must be accelerated, especially for zero-days under active exploitation; software verification should rely on official vendor channels, not search rankings; and monitoring must extend to legitimate-looking infrastructure that may be silently compromised. The integration of post-quantum key exchange in malware C2 also suggests that adversaries are preparing for future cryptographic shifts, urging defenders to consider algorithm agility in long-term security planning.
Event Type: security
Importance: high
Affected Companies
- Check Point Research
- Enveil
- Lockheed Martin
- Microsoft
Affected Sectors
- aerospace
- cybersecurity
- defense
- technology
Key Numbers
- CVE-2026-68820 CVSS score: 7.0
- Number of fake Enveil-themed websites used: 3
- DLL implant operator commands supported: 17
Timeline
- Check Point Research observed successful exploitation of CVE-2026-68820
- Check Point Research reported CVE-2026-68820 to Microsoft
- Microsoft patched CVE-2026-68820 as part of Patch Tuesday
- The Hacker News published details of Lazarus Group's exploitation of the zero-day
Frequently Asked Questions
What is CVE-2026-68820 and what systems does it affect?
CVE-2026-68820 is a privilege escalation vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys) with a CVSS score of 7.0. It allows attackers to gain SYSTEM-level access on affected Windows systems, which Lazarus Group exploited to deploy backdoors and evade detection.
How does the Troy backdoor gain persistence and execute malicious activities?
The Troy backdoor is delivered via two infection chains: DLL side-loading using a trojanized PDF viewer or a malicious PDF archive. Once executed, it loads MISTPEN, which retrieves modules from attacker-controlled OneDrive and uses the FudModule 3.1 rootkit to disable Smart App Control, enabling persistent, stealthy access to the compromised host.
Why is Lazarus Group's use of compromised legitimate infrastructure significant for defenders?
Lazarus Group hijacked compromised WordPress, SharePoint, and Roundcube servers—some vulnerable to CVE-2025-49113—to host C2 infrastructure, blending malicious traffic with legitimate web activity. This tactic undermines trust-based defenses and complicates detection by security tools relying on reputation or traffic analysis.