North Korean hackers have been exploiting a newly patched Home windows zero-day vulnerability to take over victims’ techniques, Test Level stories.
Attributed to the notorious Lazarus Group APT, the assaults symbolize a continuation of the long-running Operation Dream Job marketing campaign focusing on job seekers with faux work alternatives at well-known firms. North Korean hackers have been mounting faux job assault variations usually.
Lively since early 2026, the brand new marketing campaign has been focusing on the protection sector throughout a number of international locations, primarily aerospace and aviation organizations in Europe and India, Test Level says.
Posing as recruiters, the attackers have contacted potential victims via widespread skilled platforms or direct messaging functions and satisfied them to obtain a malicious payload.
As a part of one an infection chain, an archive containing a PDF viewer, a malicious DLL, and an encrypted payload posing as a PDF file is served to the sufferer, and DLL sideloading is used to execute the Mistpen malware downloader in reminiscence whereas a decoy job description is proven on the display screen.
The an infection chain continues with reconnaissance, persistence, and the exploitation of a beforehand unknown vulnerability in Home windows’ Ancillary Perform Driver for WinSock (afd.sys), adopted by the deployment of ForestTiger, a identified Lazarus backdoor.
The afd.sys zero-day, now tracked as CVE-2026-68820, is a use-after-free subject that enables attackers to set off a race situation and achieve System privileges.
On August 11, Microsoft fastened the vulnerability as a part of its Patch Tuesday updates, and the US cybersecurity company CISA added it to its Recognized Exploited Vulnerabilities (KEV) catalog, urging federal businesses to patch it throughout the subsequent two weeks.
In keeping with Test Level, a second an infection chain directs customers to the trojanized PDF viewer SecurityPDF, which searches for a hidden marker in any PDF file opened on the system to execute the Troy backdoor straight in reminiscence.
Troy is a brand new DLL implant that helps 17 operator instructions, together with file enumeration/obtain/add, knowledge exfiltration, shell entry, course of termination, and DLL injection.
The command-and-control (C&C) infrastructure noticed in these assaults contains compromised Roundcube webmail deployments and CMS platforms, many susceptible to CVE-2025-49113, a distant code execution (RCE) flaw that has been exploited since June 2025.
“These servers are contaminated with RelayShell, a beforehand undocumented PHP webshell that capabilities much less like a traditional backdoor and extra as a communication relay between contaminated endpoints and the operator, exchanging instructions and responses via easy textual content recordsdata,” Test Level says.
The cybersecurity agency says that protection, aerospace, and aviation organizations in France, Germany, Brazil, and India have been focused within the contemporary marketing campaign.
“Given the mix of a zero-day vulnerability that now has a patch, a brand new modular backdoor, and web-based infrastructure designed to resemble respectable site visitors, safety groups in these sectors ought to prioritize the August Patch Tuesday replace, assessment the indications of compromise, and apply the identical degree of scrutiny to unsolicited recruiting outreach that they might apply to any unverified obtain request,” Test Level notes.
Associated: New Jersey, Alabama Be a part of States Focused in Water Cyberattacks
Associated: Novel Personal APN Pivot Let Hackers Sabotage Second Polish Vitality Facility
Associated: US, Allies Warn of Russian Cyberattacks Focusing on Important Infrastructure Routers
Associated: China, India-Linked Hackers Each Focused Identical Pakistani Police Pressure
