On August 11, 2026, Check Point Research published an analysis of a new wave of Operation Dream Job conducted by the Lazarus group. The threat actor distributes SecurityPDF, a trojanized PDF viewer based on MuPDF, to open the door to Troy, a previously undocumented backdoor. The chain culminates in the exploitation of the zero-day CVE-2026-68820 in the Windows AFD.sys driver, enabling the deployment of FudModule in kernel mode with SYSTEM privileges. Microsoft released the patch the same day as part of August Patch Tuesday, following responsible disclosure by Check Point.
- SecurityPDF is a modified PDF viewer based on MuPDF that executes payloads from crafted PDFs when it detects the marker "This document is encrypted with sumatrapdf reader!!!!!!!!!!!!"; decryption uses XOR key 0x39, writes to
%TEMP%\new.exe, and launches Troy [SOURCE 1] - At least three websites impersonate the company Enveil to distribute SecurityPDF, with SEO poisoning placing them among top search results [SOURCE 1]
- CVE-2026-68820 is a zero-day LPE in AFD.sys with CVSS 7.0 HIGH; the Microsoft patch is dated August 11, 2026 [SOURCE 1]
- ESET observed the same pattern—job lure and trojanized PDF reader—in a previous wave from March 2025 targeting European defense companies, including UAV component manufacturers [SOURCE 2]
The Trust Supply Chain: How Lazarus Builds Credibility
Lazarus's social engineering does not stop at a well-crafted email. The group has built an ecosystem of cloned sites, SEO poisoning, and seemingly legitimate software to lower the victim's cognitive defenses. At least three sites impersonate Enveil, a real homomorphic encryption company, and compete in search rankings as primary results [SOURCE 1].
SecurityPDF is the core of this architecture. Based on MuPDF, an open-source framework, the viewer was modified in two code locations responsible for opening documents. When it detects the specific marker, it decrypts the payload with XOR key 0x39, writes it as %TEMP%\new.exe, and executes it [SOURCE 1]. The PDF file acts as the key; the viewer acts as the lock pick. The user sees a document opening normally; underneath, Troy installs.
The separation of the infection chain is deliberate. The viewer arrives from an SEO-optimized site; the payload comes from a different channel. This bifurcation reduces the detectable surface: an EDR monitoring only the initial download misses the second stage if the PDF is crafted ad hoc.
"The threat actor exploited CVE-2026-68820, a zero-day vulnerability in the Microsoft AFD.sys driver, to deploy a new version of FudModule" — Check Point Research
The Kernel Core: CVE-2026-68820 and FudModule
The technical breakthrough is the exploitation of CVE-2026-68820, a zero-day in the AFD.sys driver (Ancillary Function Driver for Winsock). Check Point documents that Lazarus used it to obtain SYSTEM privileges and deploy a new version of the FudModule rootkit in kernel mode [SOURCE 1]. The CVSS is 7.0, rated HIGH, with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H [SOURCE 1].
AFD.sys is a component of the Windows networking subsystem, loaded in kernel space. An LPE here means bypassing all user-mode protections, EDR included. FudModule, long documented in Lazarus's history, thus gains operational persistence and invisibility. Check Point does not specify updated EDR evasion techniques for this version, but the group's historical pattern indicates the rootkit modifies kernel structures to hide processes and connections [SOURCE 1, SOURCE 4].
Microsoft assigned the CVE and released the patch on August 11, 2026, as part of August Patch Tuesday, following responsible disclosure by Check Point [SOURCE 1]. The source does not specify whether variants of the same vulnerability remain exploitable.
Two Chains, One Objective: Mapping the Infection Chains
Check Point identifies two distinct paths. The first: DLL sideloading with a legitimate PDF viewer plus a malicious libmupdf.dll, leading to MISTPEN, documented by Mandiant in 2024 as a tool that uses Microsoft Graph API and OneDrive for C2 and additional module downloads; from there, LPE via CVE-2026-68820 and deployment of ForestTiger [SOURCE 1]. The second: SecurityPDF plus a crafted PDF, which installs Troy directly [SOURCE 1].
Lazarus also exploited CVE-2025-49113, with CVSS 9.9 CRITICAL, to compromise Roundcube servers. On these, they installed RelayShell, a PHP webshell that turns legitimate servers into C2 relays [SOURCE 1]. In at least one case, a compromised organization in Western Europe was reused for spear-phishing toward further victims, abusing the compromised domain's reputation [SOURCE 1].
Why It Matters
The dossier does not specify the exact initial contact method in the 2026 wave—LinkedIn, email, or messaging apps remain hypotheses, though Check Point indicates "likely" based on precedent [SOURCE 1]. The total number of compromised organizations is not quantified. It does not emerge whether Enveil or other companies cited as decoys (Lockheed Martin, BAE) were actually compromised or merely impersonated; Check Point explicitly states "there are no indications that the company was targeted or compromised" [SOURCE 1, UNKNOWN/LIMITS].
The source does not document specific remedial measures beyond the Microsoft patch. It does not specify whether sufficient IoCs exist for pre-execution detection of SecurityPDF, nor details on the geography of RelayShell servers or the duration of CVE-2026-68820 exploitation before disclosure.
What the brief makes evident is the evolution of the model: from phishing to a trust supply chain. The job lure is hardly filterable technically—there is no suspicious attachment, only a link to a legitimate-appearing site with a professional utility. The combination with a kernel zero-day shows sophistication that surpasses pure social engineering.
Timeline and Convergence with Previous Waves
ESET documented an Operation DreamJob wave from March 2025 targeting defense companies in Europe: metal engineering, aircraft components, UAV-related. The pattern is identical—job lure, trojanized PDF reader, DLL side-loading—with attribution to Lazarus based on ScoringMathTea and other malware families [SOURCE 2]. ESET links the UAV targeting to North Korea's drone program development [SOURCE 2].
Check Point's 2026 wave was not observed by ESET with SecurityPDF or Troy; ESET describes ScoringMathTea in the 2025 wave [SOURCE 2, THINGS NOT TO SAY]. The convergence lies in the modus operandi, not necessarily in the same samples. Two vendors, two waves, same operational philosophy.
The attack demonstrates that the defensive perimeter has shifted: no longer just endpoints and email gateways, but the validation of every "utility" software even from seemingly legitimate sites. The problem is no longer recognizing phishing; it is verifying that the trust supply chain—SEO, domain, certificate, code—has not been artfully replicated. For defense and aerospace companies, this means verification must happen out-of-band: a PDF viewer requested for a job offer must be downloaded from the original vendor's site, not from Google's top result.
Sources
- https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/
- https://www.welivesecurity.com/en/eset-research/gotta-fly-lazarus-targets-uav-sector/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60719
- https://malpedia.caad.fkie.fraunhofer.de/actor/lazarus_group
- https://www.clearskysec.com/operation-dream-job/
Information is based on the cited source and current as of publication.