Lazarus Linked to Windows Zero-Day Attacks Delivering Troy Backdoor

The North Korea-linked Lazarus Group has been observed exploiting a recently patched Windows vulnerability in attacks against defense and aerospace organizations, according to research from Check Point. The campaign targeted victims in France, Germany, Brazil and India and delivered a previously undocumented backdoor known as Troy.

The activity forms part of the long-running “Operation Dream Job” campaign, in which Lazarus operators pose as recruiters and contact professionals through platforms such as LinkedIn. Victims are presented with convincing employment opportunities and are encouraged to open malicious documents or install software advertised as a PDF viewer.

Exploitation and malware delivery

The exploited flaw, tracked as CVE-2026-68820, affects Windows Ancillary Function Driver for WinSock, or AFD.sys. Microsoft addressed the privilege-escalation vulnerability in its August 2026 security updates. Check Point said it reported the issue in late July but had identified evidence of successful exploitation dating to early June.

Researchers identified two primary infection paths. In one, an encrypted archive launches a DLL side-loading chain. A malicious library displays a fraudulent job description while loading the MISTPEN downloader in memory. MISTPEN can gather system information, enumerate processes, capture screenshots and obtain additional components, including tools used to exploit the AFD.sys flaw.

The second path uses a fake SecurityPDF application distributed through websites impersonating the security company Enveil. The application searches for a specific marker in opened documents and, when it is present, decrypts an embedded payload that loads Troy directly into memory. The backdoor supports capabilities including file transfer, data archiving, shell access, process termination, configuration changes and in-memory DLL injection.

Rootkit and compromised infrastructure

After obtaining SYSTEM-level privileges, the attackers reportedly inject malware into a privileged process and deploy FudModule 3.1, an updated kernel rootkit. The tool can interfere with Smart App Control and Windows code-integrity policy mechanisms, helping conceal the intrusion and weaken security protections.

Rather than relying solely on dedicated command-and-control infrastructure, Lazarus used compromised WordPress, SharePoint and Roundcube servers. Some Roundcube systems were reportedly breached through CVE-2025-49113 and fitted with a PHP web shell called RelayShell. The campaign also included at least three domains imitating Enveil and, in one case, used a previously compromised French organization to distribute phishing messages.

The operation demonstrates how social engineering, trusted brands, compromised websites and zero-day exploitation can be combined to bypass conventional phishing defenses and maintain access to high-value targets.