Hackers Weaponize Job Offers With Zero-Day Exploit to Gain Silent System Access

A new wave of the DPRK-linked Lazarus group’s long-running Operation Dream Job is revealing that the campaign now exploits a previously unknown Windows kernel vulnerability to seize full system control while evading endpoint detection entirely.

According to Check Point, the campaign, active since early 2026, primarily targets the global defense sector, with a sharp focus on aerospace, aviation, and military technology firms in Europe and India.

Posing as recruiters likely via LinkedIn or direct messaging, the attackers lure victims with fake job offers from well-known companies, ultimately directing them to download malicious files.

Hackers Weaponize Job Offers With Zero-Day Exploit

Check Point identified two parallel infection chains. The first uses DLL sideloading: a signed PDF viewer loads a malicious DLL that decrypts and runs MISTPEN, a lightweight in-memory downloader that abuses the Microsoft Graph API to fetch modules from OneDrive.

The second, newer chain distributes SecurityPDF, a trojanized MuPDF-based PDF viewer impersonating the privacy-tech firm Enveil.

When a victim opens a specially crafted PDF, the app checks for a hidden marker, decrypts an embedded payload with a single-byte XOR key, and ultimately launches it, deploying a previously undocumented backdoor named Troy.

The most alarming discovery is a zero-day local privilege escalation flaw in Microsoft’s AFD.sys driver, which manages Windows socket handling.

The vulnerability is a use-after-free race condition that occurs when concurrent threads access socket state without proper synchronization, granting attackers access to a kernel read/write primitive.

This is exploited to deploy a new variant of FudModule v3.1, Lazarus’ signature kernel-mode rootkit, achieving SYSTEM privileges while disabling EDR telemetry including ETW providers, minifilter drivers, and crash-dump logging.

Check Point reported the bug to Microsoft on July 28, 2026; it was confirmed within days, assigned CVE-2026-68820 on August 5, and patched on Patch Tuesday, August 11.

Compared to the 2024 FudModule v3, this version drops Defender- and AhnLab-specific bypasses in favor of generic security-product suppression, and adds new functionality to tamper with Windows Smart App Control by resetting its reputable-policy state and forcing a code-integrity policy reload.

Troy, a modular 64-bit DLL implant, supports 17 operator commands covering reconnaissance, file exfiltration, remote shell access, in-memory DLL injection, and configuration updates communicating over HTTP with Base64-encoded JSON task envelopes.

For command-and-control, Lazarus shifted from WordPress and SharePoint toward compromised Roundcube webmail servers, exploiting CVE-2025-49113, a critical PHP object-deserialization RCE using leaked dark-web credentials.

Compromised servers, along with hijacked PrestaShop sites, host RelayShell, a newly identified PHP web shell that turns infected servers into relay nodes rather than direct command executors, using a file-based messaging channel between victim and operator sessions.

Check Point identified at least 17 unique relay identifiers, with operators connecting via commercial VPN services such as ExpressVPN to mask their origin.

Victims spanned France, Germany, Brazil, and India, with one compromised French organization later weaponized to launch further spear-phishing attacks, borrowing its trusted reputation to target new victims.

The campaign underscores Lazarus’ continued shift toward stealthier, infrastructure-abusing tradecraft that blends zero-day exploitation, SEO-driven malware distribution, and legitimate web servers to mask malicious traffic as normal network activity.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR