Lazarus hackers exploited Windows zero-day to target defense firms

North Korean hackers have been exploiting CVE-2026-68820, a Windows local privilege-escalation flaw in AFD.sys (the Windows Ancillary Function Driver for WinSock), to target defense-sector organizations as part of the long-running Operation Dream Job campaign.

This matters because the flaw is not theoretical. Microsoft marked it as actively exploited in August Patch Tuesday, and Check Point linked it to Lazarus activity dating back to early July.

What Changed

According to the reporting, CVE-2026-68820 is a use-after-free vulnerability that lets a locally authenticated attacker trigger a race condition and escalate to SYSTEM without user interaction. That makes it a post-compromise accelerator: once an attacker lands on the box, this is the kind of bug that helps them turn a foothold into durable control.

Check Point says Lazarus folded the exploit into a newer version of the FudModule kernel-mode rootkit, specifically for Windows 11 builds 26100 and 26200. The same campaign also used a new backdoor called Troy and, in some cases, compromised Roundcube servers with a PHP web shell dubbed RelayShell to support follow-on operations.

Why CyberExperts Flagged It

The headline is the Windows zero-day, but the operational lesson is broader: Lazarus is combining privilege escalation, rootkit tradecraft, and abuse of legitimate web infrastructure in the same intrusion chain.

That is exactly the kind of mix that causes internal confusion if teams treat the issue as just another Patch Tuesday note. For defenders, the real question is not whether the CVE is serious. It is whether anyone can quickly answer four things: where the affected Windows builds exist, whether a suspected foothold already exists nearby, whether Roundcube exposure is part of the estate, and who owns remediation across those layers.

What Teams Should Do Next

• Patch or isolate Windows systems that could be affected by CVE-2026-68820, especially any Windows 11 fleets or privileged workstations supporting defense, aerospace, engineering, or executive workflows.
• Hunt for signs of post-compromise privilege escalation, not just internet-facing exploit attempts. This is a local EoP flaw, so the most important upstream question is whether an attacker already has code execution.
• Review telemetry for FudModule-like kernel tampering, EDR interference, Smart App Control changes, unusual service or driver behavior, and any suspicious use of local admin contexts.
• If you run Roundcube, review patch status and logs around the timeframe described by Check Point, especially for web shell indicators or suspicious authenticated activity tied to CVE-2025-49113.
• Treat this as a cross-team incident-readiness check, not just a patch task. Endpoint, identity, email/web infrastructure, and threat-hunting owners may all need to move at once.

Source: BleepingComputer, with additional public attribution and tradecraft detail cited there from Check Point.

See this item in The 5-Minute Cyber Brief

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].

Keep Reading

Explore more →

Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets

Attackers are exploiting an MLflow SSRF flaw to reach cloud metadata services and steal credentials, while a separate FUXA issue…

The 5-Minute Cyber Brief: August 28, 2026

The August 28 Cyber Brief tracks urgent Citrix and SharePoint exploitation, a critical zero-click WordPress risk, resilient GoCaracal malware, and…

TerminalFix campaign deploys a reverse tunnel through multistage intrusion

TerminalFix is valuable as a stand-alone story because it shows a modern ClickFix chain built for persistence, not just initial…