The North Korean risk actor generally known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched safety flaw impacting Microsoft Home windows to ship a never-before-seen backdoor concentrating on protection and aerospace corporations throughout France, Germany, Brazil, and India.
The exercise, per Verify Level Analysis, is a part of Operation Dream Job, a long-running cyber espionage and social engineering marketing campaign orchestrated by Pyongyang-backed hackers to focus on professionals worldwide with fake-but-compelling job presents at companies like Lockheed Martin and Enveil to steal delicate information and set up malware by approaching them on platforms like LinkedIn, pretending to be recruiters in an try and construct belief.
The assaults have been discovered to use CVE-2026-68820 (CVSS rating: 7.0), a privilege escalation flaw affecting Home windows Ancillary Operate Driver for WinSock (“AFD.sys”) that was patched by Microsoft as a part of its Patch Tuesday updates for August 2026.
Verify Level Analysis advised The Hacker Information that it reported the vulnerability to Microsoft in late July 2026, though it mentioned “we’re conversant in a profitable implementation of the CVE at first of June.”
As noticed in prior marketing campaign waves, victims are lured via bogus recruiter messages and tricked into opening a malicious PDF or putting in a trojanized PDF viewer, which is then used to put in a brand new backdoor known as Troy that grants distant entry to the compromised machine. The top objective of those intrusions is to grab full management of contaminated computer systems and bypass safety controls.
Using a trojanized PDF viewer is a tried-and-tested tactic adopted by the Lazarus Group together with Dream Job, with the risk actors abusing this methodology way back to 2022.
Two totally different parallel an infection sequences have been detected as a part of the newest assaults –
- DLL side-loading, through which victims are instructed to obtain an encrypted archive that is used to set off a DLL side-loading chain. The malicious DLL (“libmupdf.dll”) is used to show a bogus job description lure, whereas it stealthily downloads and executes in reminiscence a light-weight downloader dubbed MISTPEN. The downloader communicates with risk actor-controlled infrastructure utilizing Microsoft Graph API and OneDrive to retrieve and run reconnaissance and persistence modules and set off the “AFD.sys” driver exploit, earlier than deploying ForestTiger (aka ScoringMathTea), which supplies distant entry to the host.
- Trojanized “SecurityPDF” PDF viewer, through which victims are instructed to obtain SecurityPDF from a web site impersonating Enveil. As soon as put in, it screens for any PDF doc opened via it for a particular marker (“This doc is encrypted with sumatrapdf reader!!!!!!!!!!!!”). If such a marker is current, the appliance decrypts and launches an embedded payload that is answerable for loading a backdoor known as Troy immediately into reminiscence. The DLL implant helps 17 operator instructions to facilitate file enumeration, add and obtain, archive and exfiltration, interactive shell entry, course of termination, in-memory DLL injection, and configuration updates.
 |
| Excessive-level overview of the DLL sideloading an infection chain. |
MISTPEN, for its half, masses at the least 4 totally different modules –
- GetInfoPlugin (“Release_GetInfoPlugin_x64.dll”), to profile the host and exfiltrate the collected info as a single wide-character string
- PvPlugin (“Release_PvPlugin_x64.dll”), to gather host reconnaissance information and particulars about working processes
- OneScreenCapture (“OneScreenCapture64.dll”), to take screenshots of the present desktop, together with all screens, and transmit them as JPEG photographs
- LPE (native privilege escalation) loader, which gathers host info, generates new key materials utilizing the ML-KEM post-quantum key encapsulation algorithm, and makes use of the negotiated key through the handshake course of to decrypt and run FudModule.
The assault chain employs an up to date model of the recognized kernel-mode rootkit the Lazarus Group has repeatedly employed since at the least 2022 to hide the presence of malicious instruments from safety software program put in on the host.
 |
| One in every of web sites that rank extremely in search engine outcomes for “Enveil SecurityPDF” |
Particularly, it exploits an area privilege escalation vulnerability in “AFD.sys,” obtains SYSTEM privileges, and finally injects one other occasion of MISTPEN right into a SYSTEM course of in order to permit it to run with elevated privileges and away from the eyes of safety instruments. The newer model, known as FudModule 3.1, improves upon its predecessor by permitting it to tamper with a Home windows characteristic known as Sensible App Management designed to confirm if a program is secure to run.
“Throughout the SYSTEM-level msiexec.exe youngster course of, its distant stub units VerifiedAndReputablePolicyState to zero and invokes NtSetSystemInformation class 0xA4 with choice 0x10000000, triggering an in-place reload of the code integrity coverage,” Verify Level mentioned.
What’s extra, the attackers are mentioned to have created at the least three web sites impersonating Enveil to distribute “SecurityPDF,” though it is unclear how these faux portals had been integrated into the social engineering marketing campaign. It is suspected that the adversary first sends the PDF via a phishing message after which urges them to obtain the PDF viewer from the location to view the doc.
The domains are listed under –
- envell[.]xyz
- enveil[.]on-line
- uxtramine[.]org
What’s notable is that the marketing campaign, as an alternative of spinning up its personal bespoke infrastructure, hijacks official however compromised WordPress and SharePoint web sites and weak Roundcube webmail servers to be used as ForestTiger command-and-control (C2) servers, thereby making it much more difficult to distinguish it from regular internet visitors.
Most of the Roundcube servers have been discovered to be weak to CVE-2025-49113, with the attackers leveraging it to contaminate them with a beforehand undocumented PHP internet shell codenamed RelayShell to allow the alternate of instructions and responses within the type of textual content recordsdata. In at the least one case, an already breached France-based group was used to ship phishing messages to new victims to bypass reputation-based filters.
The newest findings present that Lazarus Group continues to hone its malware capabilities and tradecraft, whereas preserving the foundations of Dream Job largely intact in assaults geared toward important sectors internationally.
“What makes this marketing campaign so harmful just isn’t solely the zero-day vulnerability – but in addition how Lazarus wove official, trusted infrastructure into each stage of the assault,” Sergey Shykevich, director of risk intelligence at Verify Level Software program, mentioned in an announcement shared with The Hacker Information. “They hid in plain sight, behind top-ranked search outcomes, actual vendor branding, and the fame of organizations they’d already compromised.
“When the web site, the obtain and the recruiter all seem genuine, the previous recommendation to ‘spot the phishing hyperlink’ is now not simply relevant. Staying secure now means assuming that belief itself could be counterfeited: patch the second updates land, confirm software program via official channels moderately than search rankings, and prolong zero-trust considering to the legitimate-looking websites and companions we work together with daily.”
