The North Korean menace actor generally known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched safety flaw impacting Microsoft Home windows to ship a never-before-seen backdoor focusing on protection and aerospace corporations throughout France, Germany, Brazil, and India.
The exercise, per Examine Level Analysis, is a part of Operation Dream Job, a long-running cyber espionage and social engineering marketing campaign orchestrated by Pyongyang-backed hackers to focus on professionals worldwide with fake-but-compelling job provides at companies like Lockheed Martin and Enveil to steal delicate information and set up malware by approaching them on platforms like LinkedIn, pretending to be recruiters in an try and construct belief.
The assaults have been discovered to use CVE-2026-68820 (CVSS rating: 7.0), a privilege escalation flaw affecting Home windows Ancillary Operate Driver for WinSock (“AFD.sys”) that was patched by Microsoft as a part of its Patch Tuesday updates for August 2026.
Examine Level Analysis informed The Hacker Information that it reported the vulnerability to Microsoft in late July 2026, though it mentioned “we’re conversant in a profitable implementation of the CVE to start with of June.”
As noticed in prior marketing campaign waves, victims are lured via bogus recruiter messages and tricked into opening a malicious PDF or putting in a trojanized PDF viewer, which is then used to put in a brand new backdoor referred to as Troy that grants distant entry to the compromised machine. The top aim of those intrusions is to grab full management of contaminated computer systems and bypass safety controls.
The usage of a trojanized PDF viewer is a tried-and-tested tactic adopted by the Lazarus Group along side Dream Job, with the menace actors abusing this technique way back to 2022.
Two totally different parallel an infection sequences have been detected as a part of the newest assaults –
- DLL side-loading, wherein victims are instructed to obtain an encrypted archive that is used to set off a DLL side-loading chain. The malicious DLL (“libmupdf.dll”) is used to show a bogus job description lure, whereas it stealthily downloads and executes in reminiscence a light-weight downloader dubbed MISTPEN. The downloader communicates with menace actor-controlled infrastructure utilizing Microsoft Graph API and OneDrive to retrieve and run reconnaissance and persistence modules and set off the “AFD.sys” driver exploit, earlier than deploying ForestTiger (aka ScoringMathTea), which supplies distant entry to the host.
- Trojanized “SecurityPDF” PDF viewer, wherein victims are instructed to obtain SecurityPDF from a web site impersonating Enveil. As soon as put in, it screens for any PDF doc opened via it for a particular marker (“This doc is encrypted with sumatrapdf reader!!!!!!!!!!!!”). If such a marker is current, the appliance decrypts and launches an embedded payload that is chargeable for loading a backdoor referred to as Troy immediately into reminiscence. The DLL implant helps 17 operator instructions to facilitate file enumeration, add and obtain, archive and exfiltration, interactive shell entry, course of termination, in-memory DLL injection, and configuration updates.
 |
| Excessive-level overview of the DLL sideloading an infection chain. |
MISTPEN, for its half, masses no less than 4 totally different modules –
- GetInfoPlugin (“Release_GetInfoPlugin_x64.dll”), to profile the host and exfiltrate the collected info as a single wide-character string
- PvPlugin (“Release_PvPlugin_x64.dll”), to gather host reconnaissance information and particulars about operating processes
- OneScreenCapture (“OneScreenCapture64.dll”), to take screenshots of the present desktop, together with all screens, and transmit them as JPEG photographs
- LPE (native privilege escalation) loader, which gathers host info, generates new key materials utilizing the ML-KEM post-quantum key encapsulation algorithm, and makes use of the negotiated key in the course of the handshake course of to decrypt and run FudModule.
The assault chain employs an up to date model of the recognized kernel-mode rootkit the Lazarus Group has repeatedly employed since no less than 2022 to hide the presence of malicious instruments from safety software program put in on the host.
 |
| Considered one of web sites that rank extremely in search engine outcomes for “Enveil SecurityPDF” |
Particularly, it exploits an area privilege escalation vulnerability in “AFD.sys,” obtains SYSTEM privileges, and finally injects one other occasion of MISTPEN right into a SYSTEM course of in order to permit it to run with elevated privileges and away from the eyes of safety instruments. The newer model, referred to as FudModule 3.1, improves upon its predecessor by permitting it to tamper with a Home windows function referred to as Good App Management designed to confirm if a program is protected to run.
“Inside the SYSTEM-level msiexec.exe youngster course of, its distant stub units VerifiedAndReputablePolicyState to zero and invokes NtSetSystemInformation class 0xA4 with choice 0x10000000, triggering an in-place reload of the code integrity coverage,” Examine Level mentioned.
What’s extra, the attackers are mentioned to have created no less than three web sites impersonating Enveil to distribute “SecurityPDF,” though it is unclear how these pretend portals have been integrated into the social engineering marketing campaign. It is suspected that the adversary first sends the PDF via a phishing message after which urges them to obtain the PDF viewer from the positioning to view the doc.
The domains are listed under –
- envell[.]xyz
- enveil[.]on-line
- uxtramine[.]org
What’s notable is that the marketing campaign, as a substitute of spinning up its personal bespoke infrastructure, hijacks reliable however compromised WordPress and SharePoint web sites and weak Roundcube webmail servers to be used as ForestTiger command-and-control (C2) servers, thereby making it much more difficult to distinguish it from regular internet visitors.
Lots of the Roundcube servers have been discovered to be weak to CVE-2025-49113, with the attackers leveraging it to contaminate them with a beforehand undocumented PHP internet shell codenamed RelayShell to allow the change of instructions and responses within the type of textual content information. In no less than one case, an already breached France-based group was used to ship phishing messages to new victims to bypass reputation-based filters.
The newest findings present that Lazarus Group continues to hone its malware capabilities and tradecraft, whereas retaining the foundations of Dream Job largely intact in assaults aimed toward vital sectors the world over.
“What makes this marketing campaign so harmful is just not solely the zero-day vulnerability – but additionally how Lazarus wove reliable, trusted infrastructure into each stage of the assault,” Sergey Shykevich, director of menace intelligence at Examine Level Software program, mentioned in an announcement shared with The Hacker Information. “They hid in plain sight, behind top-ranked search outcomes, actual vendor branding, and the fame of organizations they’d already compromised.
“When the web site, the obtain and the recruiter all seem genuine, the previous recommendation to ‘spot the phishing hyperlink’ is now not simply relevant. Staying protected now means assuming that belief itself may be counterfeited: patch the second updates land, confirm software program via official channels reasonably than search rankings, and prolong zero-trust pondering to the legitimate-looking websites and companions we work together with day by day.”
