2026-08-12 · view entry permalink →
Lazarus burned a Windows AFD.sys zero-day (CVE-2026-68820) on European defence targets — FudModule v3.1 blinds the endpoint, and the C2 is other people's Roundcube and WordPress servers
Check Point Research published the technical analysis behind Microsoft's only exploitation-detected August Patch Tuesday entry on 2026-08-11, and the campaign behind it lands squarely on European defence organisations: the firm states its latest Operation Dream Job wave "focuses on the defense sector in Europe and India" and records "successful targeting observed in Western Europe, including France and Germany", with a compromised organisation headquartered in France subsequently reused by the operators to send spear-phishing to further targets worldwide (Check Point Research, 2026-08-11). Check Point attributes the campaign to the DPRK-linked Lazarus group and is careful about the entry point: it says the exact method used to approach victims in this wave remains unclear, and only assesses — from earlier documented Dream Job activity — that targets were likely approached through professional networking platforms or messaging apps (Check Point Research, 2026-08-11).
Background. Operation Dream Job is a long-running recruitment-lure campaign, and the driver at the centre of this intrusion is repeat ground: Check Point notes that FudModule was reported abusing CVE-2024-38193, a use-after-free in the same afd.sys driver, back in 2024, and that this build's post-exploitation behaviour is otherwise close to the FudModule v3 that Gen Digital documented that year — 94 of its hardcoded ETW-provider kill GUIDs match the first 94 entries of Gen's published 95-GUID list, in identical order (Check Point Research, 2026-08-11). What is new is the exploit chain, not the rootkit.
Two delivery chains run in parallel. In the first, the victim opens an encrypted archive holding a legitimate signed PDF-viewer executable, a malicious libmupdf.dll loaded by side-loading, and an encrypted payload carrying a .pdf extension; launching the executable displays a decoy document — Check Point's example impersonates a Lockheed Martin job description — while the DLL decrypts and runs the MISTPEN in-memory downloader, which uses the Microsoft Graph API against OneDrive to pull further modules. In the second and newer chain, victims receive offers impersonating the privacy-technology company Enveil and download "SecurityPDF", a trojanised MuPDF-based viewer whose File→Open and drag-and-drop paths were modified to look for a fixed marker string in any opened PDF, XOR-decrypt the embedded payload with a single-byte key, write it to %TEMP% and launch it as a child process; that stage reflectively loads the previously undocumented Troy backdoor, a 64-bit DLL with 17 operator commands. Check Point identified at least three websites impersonating Enveil distributing the viewer, some ranking at the top of search results, and states explicitly that Enveil itself was neither targeted nor compromised (Check Point Research, 2026-08-11).
The privilege-escalation step is the part with a CVE. After reconnaissance and persistence modules confirm the host is worth keeping, MISTPEN loads an in-memory local privilege-escalation module targeting afd.sys, the Windows Ancillary Function Driver for WinSock. Microsoft's own record describes the flaw as a use-after-free allowing an authorised attacker to elevate privileges locally, scores it CVSS 7.0 with high attack complexity, and marks it exploited but not publicly disclosed before the patch (MSRC, 2026-08-11). Check Point withholds full detail but describes the mechanism: the driver keeps a small piece of per-socket state, and under specific concurrent conditions two of its own code paths operate on that state simultaneously without synchronisation, so one path can access memory the other has already released — a race that yields a kernel read/write primitive and then SYSTEM. It confirmed on a fully patched Windows 11 system that this is a distinct, previously undocumented bug rather than the superficially similar CVE-2025-60719, and dates in-the-wild use to at least early July 2026; the sample carries an explicit minimum-version check for build 26100 (24H2) with support for 26200 (25H2). Check Point reported the issue on 28 July, Microsoft confirmed it on 31 July, assigned the CVE on 5 August and fixed it on 11 August (Check Point Research, 2026-08-11). CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-11 (CISA, 2026-08-11); Rapid7, writing before that listing appeared, noted the CVSS stayed at 7.0 largely because a stable exploit has to win the race (Rapid7, 2026-08-11).
What FudModule v3.1 does with SYSTEM is the reason this matters more than a 7.0 suggests. Check Point records the full telemetry teardown carried over from v3 — process, thread and image notify callbacks, object and registry callbacks, minifilter removal by altitude band, termination of the NT Kernel Logger, crash-dump suppression first — plus privileged-handle forgery and a two-hop spawn through services.exe into a SYSTEM msiexec.exe. The dedicated Microsoft Defender stage from v3 is gone; Defender is now blinded through the same generic security-product suppression path as any other vendor. The genuinely new capability is Smart App Control tampering: inside that SYSTEM-level msiexec.exe child, the remote stub zeroes a code-integrity policy state value and invokes NtSetSystemInformation with a specific information class to force an in-place reload of the code integrity policy (Check Point Research, 2026-08-11). The final payload differs by chain — ForestTiger, a backdoor Check Point describes as widely attributed to Lazarus, on the sideloading chain; Troy on the trojanised-viewer chain.
The command-and-control choice is deliberate and is where a defender's network telemetry has a chance. Rather than attacker-registered infrastructure, the operators run through compromised Roundcube webmail and content-management servers, reaching the Roundcube instances by combining leaked credentials with the already-public CVE-2025-49113, and plant RelayShell, a PHP webshell that repurposes those servers as relay nodes. Check Point's stated reasoning is that defence-sector networks are heavily monitored, so blending into ordinary web traffic beats standing up new domains (Check Point Research, 2026-08-11).
Detection concepts follow from the mechanics rather than from indicators. The rootkit stage produces a near-simultaneous collapse of kernel-sourced telemetry — callback registrations dropping, ETW providers stopping, minifilters unregistering — and the discriminator is what preceded it: a signed security product's own uninstaller doing this is routine maintenance, the same pattern following a document-viewer process or a SYSTEM msiexec.exe spawned two hops from services.exe is not. MISTPEN's channel is Microsoft Graph against OneDrive, so the anchor is cloud audit and identity telemetry — an endpoint process that has no business calling Graph authenticating to it — not a network signature, since the destination is legitimate Microsoft infrastructure. On the web-server side, RelayShell never executes operator commands in the request path; it splits into victim and operator modes and passes messages through files on disk, so webshell detections that key on command execution inside the HTTP request will not fire, while repeated small POSTs to a plausible-looking static-asset path plus unexplained file churn in the web root will.
Triage: a burst of ETW provider stops, callback deregistrations and minifilter removals is normal when a security product is being upgraded or uninstalled — check the parent process and the account. A vendor-signed uninstaller running under an admin session at a change window is benign; the same teardown originating from a PDF viewer's process tree, or from a SYSTEM msiexec.exe whose grandparent is services.exe with no corresponding software-deployment record, is the signal. Similarly, Graph API calls to OneDrive are ubiquitous — the discriminator is the calling process, not the destination.
its latest wave focuses on the defense sector in Europe and India.
testing on the latest fully patched Windows 11 system confirmed that the exploit targets a distinct, previously undocumented vulnerability, actively being used in the wild as a part of Operation ‘Dream Job’ since at least early July 2026.
successful targeting observed in Western Europe, including France and Germany
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.