Two espionage toolsets shipped kernel-mode rootkits in the same week whose job is to edit what Windows reports to the defender's own tools — and one of them arrived on a zero-day that was patched on Tuesday
If you did nothing this week: the August Windows update you deferred is the one that closes the flaw a North Korean intrusion was already using against defence-sector targets in France and Germany — and on any host where it landed, the endpoint agent's own view of that host is no longer evidence.
Check Point Research published the analysis behind CVE-2026-68820 on 11 August, an exploitation-detected flaw fixed in that day's Microsoft updates. Its own disclosure timeline is short: reported to the Microsoft Security Response Center on 28 July, confirmed on 31 July, CVE assigned on 5 August, fixed on Patch Tuesday. The intrusion it came from is the long-running fake-job-offer campaign, and the interesting half is what the zero-day was spent on: "During the intrusion, the threat actor exploited CVE-2026-68820, a zero-day vulnerability in the Microsoft AFD.sys driver, to deploy a new version of FudModule, Lazarus' kernel-mode rootkit" (Check Point Research, 2026-08-11). A privilege-escalation bug is worth burning as a zero-day when what it buys is kernel code execution, and what kernel code execution buys here is enumerated in the same analysis: the component set FudModule v3.1 shares with its predecessor is "The entire telemetry teardown suite: process, thread, and image notify callbacks; object and registry callbacks; minifilter removal by altitude band; and the termination of the NT Kernel Logger." Every item on that list is a mechanism by which an endpoint product learns that something happened. The European relevance is direct — Check Point records "successful targeting observed in Western Europe, including France and Germany", and that a compromised organisation headquartered in France was subsequently used to send spear-phishing to further targets, which puts a peer institution's own domain on the sending side of the lure.
Kaspersky's GReAT team published the second instance three days later: a new CoolClient backdoor variant attributed to the actor it tracks as HoneyMyte, also known as Mustang Panda, which installs a kernel-mode driver as a Windows service once the implant already holds Service Control Manager access and the SeTcbPrivilege privilege. Alongside the expected process, file and registry hiding — including unlinking the driver from PsLoadedModuleList so it stops appearing in kernel module enumeration — it carries a function with a narrower and more interesting purpose: "The driver also hooks the Nsiproxy driver to filter network-related data returned to user mode", with the user-mode component registering its own command-and-control IPv4 addresses with the driver through a dedicated control code (Kaspersky Securelist, 2026-08-14). The effect is precise: the implant's own C2 addresses are removed from the answers Windows gives to anything that asks the host what it is connected to. The driver is signed with a certificate issued to Nanjing Ranyi Technology Co., Ltd., and Kaspersky records that "The certificate was valid from August 2013 to September 2014" — long expired, which is exactly why it still works for driver loading under signature-enforcement rules that honour the signing timestamp rather than present validity.
Symantec's Jewelbug investigation, published the same week, is the user-mode expression of the same objective and worth naming for contrast rather than similarity: rather than a kernel driver, the group escaped the browser sandbox through a native-messaging host registered under the misleading name com.microsoft.runedge, running operator commands through the Windows command interpreter (Symantec Threat Hunter Team, 2026-08-13). That campaign's watering hole reached more than 15 government webmail tenants in a Middle Eastern country, not in Europe; the transferable part is the naming choice, which is aimed at an analyst reading a list of registered helpers rather than at a detection engine.
Triage: the discriminator for the driver-loading step is provenance rather than behaviour. Kernel drivers install legitimately all the time — a service creation with a kernel-driver image path is ordinary on a patch day or a software rollout. What is not ordinary is that combination arriving with a code-signing certificate whose validity period ended years ago, from a signer with no other presence in the estate, written into a directory belonging to an unrelated application rather than to a driver package; legitimate driver installs come from vendor installers with current signing chains and matching file locations. For the network-hiding behaviour specifically, the discriminator is a disagreement between two observers of the same traffic: a host reporting no connection to a destination that the egress point, the resolver or the flow record shows it talking to. That comparison is the only reliable test once the driver is resident, and it requires that the second observer already exists — which is a collection decision made before the intrusion, not during it.
During the intrusion, the threat actor exploited CVE-2026-68820, a zero-day vulnerability in the Microsoft AFD.sys driver, to deploy a new version of FudModule, Lazarus’ kernel-mode rootkit.
The entire telemetry teardown suite: process, thread, and image notify callbacks; object and registry callbacks; minifilter removal by altitude band; and the termination of the NT Kernel Logger.
successful targeting observed in Western Europe, including France and Germany
The driver also hooks the Nsiproxy driver to filter network-related data returned to user mode.
The certificate was valid from August 2013 to September 2014.
ATT&CK mapping
11 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1566.003Phishing: Spearphishing via Service
Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.
Persistence TA0003
T1176.001Software Extensions: Browser Extensions
Adversaries may abuse internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality to and customize aspects of internet browsers. They can be installed directly via a local file or custom URL or through a browser's app store - an official online platform where users can browse, install, and manage extensions for a specific web browser. Extensions generally inherit the web browser's permissions previously granted.
T1505.003Server Software Component: Web Shell
Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.
T1543.003Create or Modify System Process: Windows Service
Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Privilege Escalation TA0004
T1055Process Injection
Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
T1068Exploitation for Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
T1543.003Create or Modify System Process: Windows Service
Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Stealth TA0005
T1014Rootkit
Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
T1055Process Injection
Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Defense Impairment TA0112
T1553.002Subvert Trust Controls: Code Signing
Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. The certificates used during an operation may be created, acquired, or stolen by the adversary. Unlike Invalid Code Signature, this activity will result in a valid signature.
T1685Disable or Modify Tools
Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.
T1685.001Disable or Modify Tools: Disable or Modify Windows Event Log
Adversaries may disable or modify the Windows Event Log to limit data that can be leveraged for detections and audits. Windows Event Log records user and system activity such as login attempts and process creation. This data is used by security tools and analysts to generate detections.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.