Lazarus Group Exploits Windows Zero-Day in Backdoor Campaign

Post Views: 11

A North Korean cyber threat actor operating under the alias Lazarus Group has initiated a fresh phase of its “Operation Dream Job” campaign, utilizing a Windows zero-day vulnerability addressed in recent updates to deploy malicious backdoors, according to security researchers.

Operation Dream Job Campaign

The assault vector involves deceptive job recruitment messages distributed via direct messaging platforms and targeted at defense and aerospace industry professionals in Europe and India. Attackers impersonate hiring managers and direct recipients to download compromised files.

Malicious Archive and Encrypted Payload

The latest iteration of the attack includes a malicious archive containing a malicious dynamic link library (DLL), an encrypted payload disguised as a PDF document, and a legitimate, digitally signed PDF viewer named SmartaPDF.exe. When the PDF viewer is executed, it loads the malicious DLL, libmupdf.dll, which decrypts the payload and presents a decoy document while simultaneously initiating a secondary attack chain.

Attack Chain and Privilege Escalation

This chain establishes communication with attacker-controlled infrastructure through Microsoft Graph API and OneDrive services, deploying reconnaissance and persistence modules. The threat actors then exploit CVE-2026-68820 to escalate privileges to kernel level, enabling deployment of a rootkit called FudModule v3.1. This malware variant disables system logging mechanisms, suppresses security software, and disrupts Smart App Control functionality.

Denis Calderone, chief technology officer at Suzu Labs, highlighted that this marks the third instance in 24 months where Lazarus has exploited vulnerabilities in Windows system drivers to deploy FudModule. Previous attacks targeted flaws in appid.sys (CVE-2024-21338) and AFD.sys (CVE-2024-38193). Calderone explained that while traditional methods involved exploiting third-party drivers, Lazarus has shifted to leveraging vulnerabilities in core Windows components.

Evolving Tactics and Infrastructure

The AFD.sys driver, responsible for network socket operations across all Windows systems, cannot be effectively blocked through standard allowlisting measures. The attack chain ultimately deploys two distinct backdoor variants. The primary method involves a previously documented backdoor named ForestTiger, while an alternative approach uses a newly identified backdoor called Troy. In this variant, victims are directed to open a malicious PDF containing a fabricated job offer, which triggers the deployment of Troy directly into memory.

Troy Backdoor Capabilities

Troy supports 17 command-and-control functions, including interactive shell access, process termination, in-memory DLL injection, and file enumeration and transfer capabilities. The threat actors increasingly utilize compromised WordPress and Roundcube Webmail servers as infrastructure for hosting their backdoors, specifically ForestTiger.

Researchers identified multiple infected Roundcube instances vulnerable to a remote code execution flaw tracked as CVE-2025-49113. Compromised platforms also contained a PHP webshell named RelayShell. Check Point Research confirmed at least 12 instances of CVE-2026-68820 exploitation, with the vulnerability reported to Microsoft and resolved through the August 2026 Patch Tuesday updates.

Vulnerability Context and Mitigation

This patch addressed over 400 security flaws, with CVE-2026-68820 included in the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. Federal civilian agencies were mandated to apply the fix by August 25. The vulnerability carries a CVSS score of 7.0, classified as Important.

Security Prioritization Concerns

Calderone criticized the prioritization of vulnerability remediation, noting that this flaw would be deprioritized in many organizations due to its severity rating compared to unexploited remote code execution vulnerabilities.

Conclusion

The attack methodology demonstrates evolving tactics by state-sponsored actors to bypass modern security controls through novel exploitation techniques and infrastructure diversification.