Lazarus Exploits Windows AFD.sys Zero-Day CVE-2026-68820 in Defense Cyberattacks

Microsoft has released security updates addressing an actively exploited Windows zero-day vulnerability, tracked as CVE-2026-68820, which state-sponsored North Korean threat actors leveraged against global defense contractors. The flaw resides in the Windows Ancillary Function Driver for WinSock (AFD.sys) and allows local unprivileged attackers to escalate privileges to SYSTEM level. Research from cybersecurity firm Check Point reveals that the Lazarus Group integrated an exploit for CVE-2026-68820 into their long-running Operation Dream Job campaign starting in early July, deploying an updated version of their FudModule rootkit to disable endpoint defenses across compromised networks.

Inside CVE-2026-68820 and Kernel-Level Exploitation

The core flaw in CVE-2026-68820 stems from a use-after-free (UAF) condition within AFD.sys, the core kernel driver responsible for supporting Windows Sockets network communications. When an application requests socket handles, AFD.sys manages the allocation and destruction of underlying kernel objects in system memory. By running a specially crafted local binary, an authenticated attacker can trigger a race condition that manipulates freed memory addresses before the operating system clears them.

Because the flaw executes entirely in kernel space, successful exploitation grants the attacker full SYSTEM privileges without requiring administrative credentials or any user interaction. In this campaign, Lazarus targeted specific Windows 11 environments, engineering the exploit binary to explicitly support builds 26100 (24H2) and 26200.

Historically, kernel privilege escalation relies on Bring Your Own Vulnerable Driver (BYOVD) tactics, where attackers drop a legitimately signed third-party driver with known flaws to manipulate kernel objects. By exploiting a native zero-day in AFD.sys, Lazarus completely bypasses modern Windows defenses like Driver Signature Enforcement (DSE) and Hypervisor-Protected Code Integrity (HVCI). This native execution path allows them to directly modify kernel structures via Direct Kernel Object Manipulation (DKOM).

FudModule Updates and the Troy Backdoor

Once local privilege escalation is achieved, Lazarus deploys a modernized variant of its proprietary kernel-mode rootkit, known as FudModule. FudModule operates deep within system memory to neutralize security agent capabilities before security operations centers (SOC) can register alerts.

Key functional capabilities observed in this latest iteration include:

• Telemetry Disabling: Stripping Event Tracing for Windows (ETW) routines and unhooking EDR kernel callbacks to blind endpoint security tools.
• Smart App Control Tampering: Disabling Windows Smart App Control features to ensure untrusted secondary binaries run without triggering user-prompt warnings.
• Security Product Interference: Modifying memory structures associated with registered anti-malware services to prevent active scanning and process termination.

With kernel-level control established, the attackers drop a newly identified backdoor dubbed Troy. Designed for persistence and espionage, Troy supports 17 distinct operational commands. Its core capabilities cover complete file system manipulation—including file upload, download, targeted file deletion, and local directory archiving—enabling automated staging of proprietary intelligence prior to exfiltration.

Operation Dream Job Tactics and RelayShell Infrastructure

The initial access vector remains consistent with Lazarus’s signature Operation Dream Job tradecraft. Attackers contact employees at defense, aerospace, and aviation firms via social engineering lures, presenting fake job offers for high-profile positions. These lures trick targets into opening weaponized attachments or downloading malicious packages containing initial stage downloaders.

However, Lazarus altered its command-and-control (C2) operational security during this run by abusing legitimate, third-party mail infrastructure to proxy C2 traffic and conceal malicious payloads:

1. Target Scanning & Access: Attackers performed widespread automated scans against public-facing Roundcube webmail installations, using leaked or compromised credentials to authenticate.
2. Object Deserialization RCE: Once authenticated, they exploited CVE-2025-49113, an authenticated PHP object-deserialization vulnerability in Roundcube, to achieve remote code execution.
3. RelayShell Deployment: Lazarus deployed a novel PHP web shell named RelayShell across at least 17 compromised Roundcube webmail servers. In at least one documented instance, a compromised organization in France was weaponized as an upstream pivot to launch spear-phishing campaigns against additional defense entities.

By routing C2 communications and payload delivery through these compromised Roundcube nodes, Lazarus obfuscates malicious network egress, effectively bypassing domain reputation lists, standard firewalls, and proxy controls.

Affected Sectors and Realistic Blast Radius

This Operation Dream Job campaign demonstrated broad geographic coverage, impacting organizations across Western Europe (including France and Germany), South America (including Brazil), and India. The targeting specifically focused on military contractors specializing in critical technologies, including surveillance sensors, uncrewed aerial vehicles (drones), and defense robotics.

The blast radius for defense sector organizations compromised in this campaign is severe. Attaining local kernel privileges via CVE-2026-68820 enables threat actors to completely evade host-based security tools, dump credentials, capture raw network traffic, and exfiltrate controlled defense information (CDI), engineering schematics, and export-controlled intellectual property. Furthermore, hijacking trusted supply chain entities exposes secondary targets across the broader defense industrial base to highly trusted spear-phishing attacks.

Recommended Mitigation and Remediation

Defenders should immediately execute the following mitigation and hunting procedures:

• System Patching: Deploy Microsoft’s latest security updates covering CVE-2026-68820 across all Windows endpoints, prioritizing Windows 11 build 26100 and 26200 systems.
• Webmail Security: Update all Roundcube deployments to patch CVE-2025-49113, force account-wide credential resets across webmail portals, and inspect PHP web directories for anomalous files corresponding to RelayShell.
• Web Shell Detection: Run the YARA rule published in Check Point’s technical report to scan web servers for RelayShell indicators and audit web server execution logs for unexpected PHP process spawns.
• Kernel & EDR Monitoring: Monitor endpoints for unexpected privilege escalation from low-rights processes, modification of AFD.sys file handles, or sudden drops in EDR telemetry generation indicating driver callback tampering.