Lazarus Exploits Windows AFD.sys Zero-Day for SYSTEM: Third Time…

The North Korean group used CVE-2026-68820 for local privilege escalation to SYSTEM, deploying the FudModule 3.1 rootkit and Troy backdoor against the defense sector. Active exploitation began in early June 2026, roughly two months before Microsoft patched it on the August 11 Patch Tuesday.

The Lazarus Group exploited the CVE-2026-68820 zero-day to gain SYSTEM privileges on Windows 11, deploying the new Troy backdoor and the FudModule 3.1 rootkit against defense and aerospace companies in France, Germany, Brazil, and India. Active exploitation began in early June 2026, roughly two months before Microsoft released the patch in the August 11 Patch Tuesday update. Check Point Research, which discovered and reported the vulnerability to Microsoft in late July, documents an attack chain that blends social engineering, compromised legitimate infrastructure, and built-in Windows drivers that cannot be blocklisted.

Key Takeaways

CVE-2026-68820 is a use-after-free in AFD.sys with CVSS 7.0: local escalation to SYSTEM via race condition, not RCE
Microsoft patched on August 11, 2026; CISA added the CVE to the KEV catalog with a federal agency patch deadline of August 25, 2026
Troy is a new in-memory backdoor supporting 17 commands for exfiltration, interactive shell, and DLL injection
FudModule 3.1 disables Smart App Control and EDR telemetry using native Windows kernel drivers, without BYOVD techniques

The Mechanism: From AFD.sys to SYSTEM Without Third-Party Drivers

The vulnerability resides in the AFD.sys driver (Ancillary Function Driver for WinSock), a component built into every Windows system that manages socket operations. According to the official NVD record, it is a use-after-free with a CVSS 3.1 vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H and a base score of 7.0. An attacker with local access and low privileges can trigger a race condition to elevate rights to SYSTEM.

Lazarus’ tactical innovation lies in completely avoiding Bring Your Own Vulnerable Driver (BYOVD), a technique now controlled by EDR vendor blocklists. By exploiting a bug in a driver that Windows installs and loads by default, the group bypasses deny-list-based defense mechanisms. This is the third documented case in two years: previous zero-days in AFD.sys and related drivers — CVE-2024-21338 and CVE-2024-38193 — were already exploited for similar operations.

Operation Dream Job Reinforced: From LinkedIn to Fake Sites in Top Google Rankings

The campaign falls under Operation Dream Job, Lazarus’ social engineering program active since 2020 that uses fake job offers to infiltrate strategic organizations. The novelty in this iteration is the use of compromised legitimate infrastructure and fake sites impersonating real companies, positioned at the top of search engine results.

Check Point identified at least three fake domains impersonating Enveil — envell[.]xyz, enveil[.]online, uxtramine[.]org — used to distribute a trojanized PDF viewer dubbed SecurityPDF. At least one of these sites reached the first position for relevant searches. According to the source, there is no indication that Enveil itself was targeted or compromised; this is pure brand impersonation. In at least one case, an already-compromised French organization was used as a platform to send new spear-phishing emails to potential victims.

Troy, FudModule 3.1, and the RelayShell Infrastructure: The Post-Exploitation Chain

Once SYSTEM is obtained, operators load FudModule 3.1, an updated kernel-mode rootkit that alters the VerifiedAndReputablePolicyState to zero and invokes NtSetSystemInformation with class 0xA4 and option 0x10000000, triggering an in-place reload of the code integrity policy. The result is the neutralization of Smart App Control and EDR telemetry.

Simultaneously, Troy is deployed, a new in-memory backdoor that Check Point describes with 17 operational commands: file enumeration, upload and download, archiving and exfiltration, interactive shell, process termination, in-memory DLL injection, and configuration update. Two parallel infection chains have been documented: one based on DLL side-loading with the MISTPEN tool, the other on the SecurityPDF viewer.

The command-and-control infrastructure relies on compromised WordPress and SharePoint sites, as well as Roundcube servers vulnerable to CVE-2025-49113. For the latter, RelayShell has been documented, a new PHP web shell that enables remote control of compromised mail servers. Check Point identified at least 17 unique servers associated with this relay network.

"For a while, the standard playbook for getting kernel access was bring-your-own-vulnerable-driver... Lazarus adapted by finding bugs in drivers that Windows ships by default. AFD.sys handles every socket operation on every Windows machine. You can't blocklist it."
— Denis Calderone, CTO at Suzu Labs

The CVSS 7.0 That Beats Critical RCEs: When Risk Triage Fails

The case exposes a systemic distortion in vulnerability management programs. CVE-2026-68820 carries a CVSS 7.0 score, classified as "Important" by Microsoft. In a triage based solely on severity score, this local LPE with race conditions would land in the middle of the queue, behind critical RCEs never observed in real-world exploitation.

The reality is different: Lazarus actively exploited this flaw for two months, gaining SYSTEM privileges on patched Windows 11 endpoints, bypassing EDR and Smart App Control, and maintaining persistence in high-security sectors. The dossier does not document specific remedial measures beyond applying the patch, but the discrepancy between theoretical score and operational impact is the central takeaway. According to Calderone, triaging by CVSS is "exactly backwards" from what is needed against APT actors.

What to Do Now

Immediately apply the August 2026 Patch Tuesday update for CVE-2026-68820, with maximum priority for defense and aerospace sector systems
Check for indicators related to Troy, FudModule 3.1, and RelayShell in already-compromised networks, given the duration of active exploitation since June
Revise patch prioritization criteria: a confirmed APT-exploited LPE must outrank unexploited RCEs regardless of CVSS score
Monitor traffic to the documented fake domains and audit social engineering trust chains, including sites in top search engine positions

Who Was Behind It and What We Still Don’t Know

Attribution to Lazarus Group is documented by Check Point and corroborated by convergent sources based on infrastructure, modules, and overlap with Operation Dream Job. No infrastructure overlaps linking the actor to other groups have emerged at this time. The dossier does not specify whether the zero-day was used by other actors beyond Lazarus, nor the full extent of compromises beyond the known cases in four countries.

How researchers gained visibility into the June exploitation is not stated in the brief: likely incident response or honeypot, but the method remains unspecified. Equally uncertain is the exact mechanism of integration of the fake sites into the social engineering chain: a plausible hypothesis is a pre-sent PDF followed by the viewer download, but the sequence is not documented.

"What makes this campaign so dangerous is not only the zero-day vulnerability – but also how Lazarus wove legitimate, trusted infrastructure into every stage of the attack. They hid in plain sight, behind top-ranked search results, real vendor branding, and the reputation of organizations they had already compromised."
— Sergey Shykevich, director of threat intelligence at Check Point Software

The campaign signals a qualitative evolution in the threat model: no longer simple low-tech phishing, but an ecosystem where every link — search engine, compromised site, impersonated brand, system driver — carries apparent legitimacy. For defenders, the implication is that link verification as a sole control is no longer enough. The real differentiator becomes the ability to recognize anomalous activity after initial access, when the attacker already operates with SYSTEM privileges and kernel-mode tools.

FAQ

Why is AFD.sys particularly dangerous compared to other Windows drivers?

Because it is present on every Windows system and handles all network socket operations: it cannot be blocklisted without breaking the operating system’s network functionality.

Is Smart App Control permanently disabled by FudModule 3.1?

The dossier documents that FudModule 3.1 alters the code integrity policy state, but does not specify whether the modification is permanent or reversible without a reboot.

Does the Troy backdoor write to disk or operate only in-memory?

Check Point describes Troy as an in-memory backdoor with DLL injection capabilities, but does not clarify whether all its operations occur exclusively in RAM or if they persist in other forms.

Information has been verified against cited sources and updated at the time of publication.

Sources

Sources and references