The most sophisticated attack chain of the month starts with the least sophisticated thing imaginable: a friendly LinkedIn message from a recruiter. Check Point Research has tied the actively-exploited Windows afd.sys zero-day (CVE-2026-68820) to North Korea’s Lazarus Group, in a campaign called “Operation Dream Job” that runs from a fake job offer all the way to a kernel rootkit on the machines of defense and aerospace engineers. It’s a textbook example of how real nation-state intrusions actually happen — and the entry point is a person, not a payload.
The kill chain, start to finish
- The lure. A target — typically an engineer at a defense or aerospace firm — receives a LinkedIn message from a “recruiter” impersonating hiring staff at real companies like Lockheed Martin or the security firm Enveil. The pitch is a dream job.
- The delivery. The conversation leads to a “job description” the victim is asked to open: a malicious PDF, or a trojanized PDF viewer downloaded from a lookalike site.
- The escalation. Once code is running as the user, the attackers exploit CVE-2026-68820 — the use-after-free in the
afd.sysWinSock driver (CVSS 7.0) — to jump from a normal user to SYSTEM. - The payload. With SYSTEM privileges, they deploy the Troy backdoor and, in one variant, a kernel rootkit for long-term persistence.
Notably, Check Point observed exploitation of the zero-day as early as the beginning of June — the flaw wasn’t reported to Microsoft until late July and wasn’t patched until the August Patch Tuesday. Lazarus had a working exploit for months before defenders had a fix.
Two flavors of the same operation
Check Point documented two delivery variants, and both are instructive:
The DLL side-loading path: an encrypted archive triggers a side-loading chain where a malicious libmupdf.dll displays a convincing fake job description while quietly downloading the MISTPEN downloader in the background. MISTPEN is clever about staying hidden — it uses the Microsoft Graph API and OneDrive for command-and-control, so its traffic blends into normal Microsoft 365 activity. From there it loads a suite of plugins (info-stealing, screen capture, a privilege-escalation loader) and deploys the FudModule 3.1 rootkit for persistence Check Point tracks as “ForestTiger.”
The fake-PDF-viewer path: lookalike sites impersonate Enveil (domains like envell[.]xyz, enveil[.]online, and uxtramine[.]org) and push a booby-trapped “SecurityPDF” viewer. When a PDF contains a specific hidden marker string, an embedded payload fires and loads the Troy backdoor directly into memory, where it exposes 17 operator commands.
What Troy can do once it’s in
The Troy backdoor is a full remote-access toolkit. Per Check Point it supports file enumeration, upload and download, archiving and exfiltration, interactive shell access, process termination, in-memory DLL injection, and remote configuration updates. In plain terms: once Troy is running as SYSTEM, the operator can see everything, take anything, run anything, and adapt on the fly — all from the machine of an engineer who thought they were applying for a job.
The detail defenders keep underestimating: living off legitimate infrastructure
Lazarus didn’t stand up a farm of obvious malicious servers. Instead they hijacked legitimate, compromised websites — real WordPress and SharePoint installations, and vulnerable Roundcube webmail servers — and used those as command-and-control. The Roundcube servers were compromised via CVE-2025-49113 and seeded with a PHP web shell called “RelayShell.”
This is the part that defeats naive detection. When a beacon phones home to a compromised-but-legitimate corporate website, or to OneDrive via the Graph API, there’s no sketchy new domain to blocklist and no unusual destination to flag. The traffic looks normal because it is going to normal places. Detection has to move from “is this destination bad?” to “is this behavior normal for this host?” — which is a much harder question most defenses aren’t set up to answer.
Why “Operation Dream Job” keeps working
This isn’t Lazarus’s first fake-recruiter campaign — “Operation Dream Job” is a years-long playbook, and it keeps working for a simple reason: it targets the one part of the system you can’t patch. A skilled engineer flattered by a Lockheed Martin recruiter, in the middle of a job conversation, is primed to open the “role description.” The exploit chain behind it is advanced, but it only ever gets to run because a human made a reasonable-seeming decision first. Every layer after that — the DLL, the zero-day, the rootkit — is downstream of that first click.
What to actually do
For individuals in targeted sectors (defense, aerospace, and increasingly any high-value tech role):
- Treat unsolicited recruiter outreach as an attack surface. A real job never requires you to open an “encrypted” PDF that needs a special downloaded viewer, or to run an installer from a link in a DM. That specific ask is the tell.
- Verify software through official channels, not search results or links. Lazarus impersonates real security vendors precisely because people trust the brand — go to the vendor’s real site directly.
- Be suspicious of any document that says it needs a particular reader to “decrypt” it.
For defenders and organizations:
- Patch CVE-2026-68820 now if you haven’t — it’s the escalation step that turns a phishing foothold into full compromise, and it’s being actively used.
- Extend zero-trust thinking to legitimate-looking destinations. Monitor for anomalous use of the Graph API / OneDrive from endpoints, and treat outbound connections to random WordPress/SharePoint sites as worth investigating even though the domains look benign.
- Hunt for the known indicators — the fake Enveil domains, RelayShell on Roundcube servers, and the FudModule/ForestTiger persistence artifacts — and patch CVE-2025-49113 on any Roundcube you run so you’re not unwittingly hosting someone’s C2.
- Reinforce with your engineers that the recruiter lure is a known, active technique aimed specifically at them.
The bottom line
Operation Dream Job is a reminder that the frontier of nation-state attacks isn’t only exotic exploits — it’s the seamless fusion of a human lure, a patched-too-late zero-day, and infrastructure that hides in plain sight. The afd.sys bug did the privilege escalation, but a LinkedIn message did the hard part. Patch the zero-day, yes — but the highest-leverage defense against this campaign is teaching the people it targets to recognize the dream job that’s too good to be true.
Sources: The Hacker News — Lazarus Exploits Windows Zero-Day to Deploy Troy Backdoor (research by Check Point Research). Verify indicators against your own environment before acting; attribution and campaign details are as reported by Check Point.