Lazarus burned a Windows AFD.sys zero-day (CVE-2026-68820) on European defence targets — FudModule v3.1 blinds the endpoint, and the C2 is other people's Roundcube and WordPress servers
Check Point Research published the technical analysis behind Microsoft's only exploitation-detected August Patch Tuesday entry on 2026-08-11, and the campaign behind it lands squarely on European defence organisations: the firm states its latest Operation Dream Job wave "focuses on the defense sector in Europe and India" and records "successful targeting observed in Western Europe, including France and Germany", with a compromised organisation headquartered in France subsequently reused by the operators to send spear-phishing to further targets worldwide (Check Point Research, 2026-08-11). Check Point attributes the campaign to the DPRK-linked Lazarus group and is careful about the entry point: it says the exact method used to approach victims in this wave remains unclear, and only assesses — from earlier documented Dream Job activity — that targets were likely approached through professional networking platforms or messaging apps (Check Point Research, 2026-08-11).
Background. Operation Dream Job is a long-running recruitment-lure campaign, and the driver at the centre of this intrusion is repeat ground: Check Point notes that FudModule was reported abusing CVE-2024-38193, a use-after-free in the same afd.sys driver, back in 2024, and that this build's post-exploitation behaviour is otherwise close to the FudModule v3 that Gen Digital documented that year — 94 of its hardcoded ETW-provider kill GUIDs match the first 94 entries of Gen's published 95-GUID list, in identical order (Check Point Research, 2026-08-11). What is new is the exploit chain, not the rootkit.
Two delivery chains run in parallel. In the first, the victim opens an encrypted archive holding a legitimate signed PDF-viewer executable, a malicious libmupdf.dll loaded by side-loading, and an encrypted payload carrying a .pdf extension; launching the executable displays a decoy document — Check Point's example impersonates a Lockheed Martin job description — while the DLL decrypts and runs the MISTPEN in-memory downloader, which uses the Microsoft Graph API against OneDrive to pull further modules. In the second and newer chain, victims receive offers impersonating the privacy-technology company Enveil and download "SecurityPDF", a trojanised MuPDF-based viewer whose File→Open and drag-and-drop paths were modified to look for a fixed marker string in any opened PDF, XOR-decrypt the embedded payload with a single-byte key, write it to %TEMP% and launch it as a child process; that stage reflectively loads the previously undocumented Troy backdoor, a 64-bit DLL with 17 operator commands. Check Point identified at least three websites impersonating Enveil distributing the viewer, some ranking at the top of search results, and states explicitly that Enveil itself was neither targeted nor compromised (Check Point Research, 2026-08-11).
The privilege-escalation step is the part with a CVE. After reconnaissance and persistence modules confirm the host is worth keeping, MISTPEN loads an in-memory local privilege-escalation module targeting afd.sys, the Windows Ancillary Function Driver for WinSock. Microsoft's own record describes the flaw as a use-after-free allowing an authorised attacker to elevate privileges locally, scores it CVSS 7.0 with high attack complexity, and marks it exploited but not publicly disclosed before the patch (MSRC, 2026-08-11). Check Point withholds full detail but describes the mechanism: the driver keeps a small piece of per-socket state, and under specific concurrent conditions two of its own code paths operate on that state simultaneously without synchronisation, so one path can access memory the other has already released — a race that yields a kernel read/write primitive and then SYSTEM. It confirmed on a fully patched Windows 11 system that this is a distinct, previously undocumented bug rather than the superficially similar CVE-2025-60719, and dates in-the-wild use to at least early July 2026; the sample carries an explicit minimum-version check for build 26100 (24H2) with support for 26200 (25H2). Check Point reported the issue on 28 July, Microsoft confirmed it on 31 July, assigned the CVE on 5 August and fixed it on 11 August (Check Point Research, 2026-08-11). CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-11 (CISA, 2026-08-11); Rapid7, writing before that listing appeared, noted the CVSS stayed at 7.0 largely because a stable exploit has to win the race (Rapid7, 2026-08-11).
What FudModule v3.1 does with SYSTEM is the reason this matters more than a 7.0 suggests. Check Point records the full telemetry teardown carried over from v3 — process, thread and image notify callbacks, object and registry callbacks, minifilter removal by altitude band, termination of the NT Kernel Logger, crash-dump suppression first — plus privileged-handle forgery and a two-hop spawn through services.exe into a SYSTEM msiexec.exe. The dedicated Microsoft Defender stage from v3 is gone; Defender is now blinded through the same generic security-product suppression path as any other vendor. The genuinely new capability is Smart App Control tampering: inside that SYSTEM-level msiexec.exe child, the remote stub zeroes a code-integrity policy state value and invokes NtSetSystemInformation with a specific information class to force an in-place reload of the code integrity policy (Check Point Research, 2026-08-11). The final payload differs by chain — ForestTiger, a backdoor Check Point describes as widely attributed to Lazarus, on the sideloading chain; Troy on the trojanised-viewer chain.
The command-and-control choice is deliberate and is where a defender's network telemetry has a chance. Rather than attacker-registered infrastructure, the operators run through compromised Roundcube webmail and content-management servers, reaching the Roundcube instances by combining leaked credentials with the already-public CVE-2025-49113, and plant RelayShell, a PHP webshell that repurposes those servers as relay nodes. Check Point's stated reasoning is that defence-sector networks are heavily monitored, so blending into ordinary web traffic beats standing up new domains (Check Point Research, 2026-08-11).
Detection concepts follow from the mechanics rather than from indicators. The rootkit stage produces a near-simultaneous collapse of kernel-sourced telemetry — callback registrations dropping, ETW providers stopping, minifilters unregistering — and the discriminator is what preceded it: a signed security product's own uninstaller doing this is routine maintenance, the same pattern following a document-viewer process or a SYSTEM msiexec.exe spawned two hops from services.exe is not. MISTPEN's channel is Microsoft Graph against OneDrive, so the anchor is cloud audit and identity telemetry — an endpoint process that has no business calling Graph authenticating to it — not a network signature, since the destination is legitimate Microsoft infrastructure. On the web-server side, RelayShell never executes operator commands in the request path; it splits into victim and operator modes and passes messages through files on disk, so webshell detections that key on command execution inside the HTTP request will not fire, while repeated small POSTs to a plausible-looking static-asset path plus unexplained file churn in the web root will.
Triage: a burst of ETW provider stops, callback deregistrations and minifilter removals is normal when a security product is being upgraded or uninstalled — check the parent process and the account. A vendor-signed uninstaller running under an admin session at a change window is benign; the same teardown originating from a PDF viewer's process tree, or from a SYSTEM msiexec.exe whose grandparent is services.exe with no corresponding software-deployment record, is the signal. Similarly, Graph API calls to OneDrive are ubiquitous — the discriminator is the calling process, not the destination.
its latest wave focuses on the defense sector in Europe and India.
testing on the latest fully patched Windows 11 system confirmed that the exploit targets a distinct, previously undocumented vulnerability, actively being used in the wild as a part of Operation ‘Dream Job’ since at least early July 2026.
successful targeting observed in Western Europe, including France and Germany
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Defender actions
- Deploy the August 2026 Windows cumulative update to every Windows 11 24H2/25H2 endpoint that handles externally-sourced documents — CVE-2026-68820 is the exploited step that turns a user-level foothold into SYSTEM and removes endpoint visibility.
- Check every internet-facing Roundcube instance against the vendor's 2025 advisory for CVE-2025-49113 and treat any unpatched hit as a candidate C2 relay node rather than only a mail-data exposure — look for unexpected PHP files in the web root and repeated small POSTs to plausible-looking static-asset paths.
ATT&CK mapping
18 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Resource Development TA0042
T1608.006Stage Capabilities: SEO Poisoning
Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims. Search engines typically display results to users based on purchased ads as well as the site’s ranking/score/reputation calculated by their web crawlers and algorithms.
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
T1566.003Phishing: Spearphishing via Service
Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.
Execution TA0002
T1204.002User Execution: Malicious File
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.
T1574.001Hijack Execution Flow: DLL
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.
Persistence TA0003
T1505.003Server Software Component: Web Shell
Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.
Privilege Escalation TA0004
T1055Process Injection
Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
T1068Exploitation for Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Stealth TA0005
T1014Rootkit
Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
T1027.009Obfuscated Files or Information: Embedded Payloads
Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. In some cases, embedded payloads may also enable adversaries to Subvert Trust Controls by not impacting execution controls such as digital signatures and notarization tickets.
T1055Process Injection
Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
T1140Deobfuscate/Decode Files or Information
Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
T1574.001Hijack Execution Flow: DLL
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.
T1620Reflective Code Loading
Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).
Defense Impairment TA0112
T1685Disable or Modify Tools
Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.
Discovery TA0007
T1057Process Discovery
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
T1082System Information Discovery
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.
Collection TA0009
T1113Screen Capture
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.
Command and Control TA0011
T1102.002Web Service: Bidirectional Communication
Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.
T1105Ingress Tool Transfer
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.