Lazarus Hits Windows Kernel: Zero-Day CVSS 7.0 with APT Impact

North Korea's Lazarus Group actively exploited CVE-2026-68820, a zero-day in the Windows AFD.sys driver, for over five weeks to gain SYSTEM privileges and deploy the Troy backdoor alongside the FudModule 3.1 rootkit.

North Korea's Lazarus Group actively exploited a zero-day in the Windows kernel driver AFD.sys — CVE-2026-68820, rated CVSS 7.0 and classified "Important" — for over five weeks to escalate privileges to SYSTEM and install the Troy backdoor, documented for the first time in this campaign, alongside the FudModule 3.1 rootkit. The convergence of independent sources — Check Point Research (original discovery), Microsoft (vendor), NVD, and CISA (federal government) — confirms the operational gravity of a vulnerability that its technical score alone fails to capture. Check Point reported the flaw to Microsoft on July 28, 2026; the patch arrived on August 11, 2026, the same day CISA added it to the KEV catalog with a federal due date of August 25.

Key Takeaways

CVE-2026-68820 is a race-condition use-after-free in the Windows AFD.sys driver that allows privilege escalation to SYSTEM without user interaction, per Microsoft MSRC.
Lazarus exploited the vulnerability from at least early June 2026, with a FudModule artifact dated July 7 — five weeks before the patch.
The campaign hit France, Germany, Brazil, and India via two parallel infection chains: DLL sideloading with the MISTPEN downloader and a trojanized PDF viewer, SecurityPDF, that delivers the Troy backdoor.
The CVSS 7.0 rates the flaw "Important," not "Critical"; experts warn that vulnerability-management programs relying solely on scores risk deprioritizing a bug already exploited by an APT.

The Mechanism: A Race Condition at the Heart of the Windows Network Stack

The vulnerability resides in AFD.sys, the Ancillary Function Driver for WinSock that handles every socket operation on every Windows machine. The official NVD record for CVE-2026-68820 describes a use-after-free with CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The Microsoft MSRC advisory confirms: "An attacker who successfully exploited this vulnerability could gain SYSTEM privileges" and adds: "User interaction is not required."

Attack complexity is high (AC:H) because, as Microsoft notes, "successful exploitation of this vulnerability requires an attacker to win a race condition." The local nature of the bug explains the contained score. Lazarus does not need remote RCE when it already controls a compromised endpoint via social engineering.

Note on Known Limits: Check Point notes that the initial access vector is unconfirmed for all victims. The exact method used to approach targets in the current campaign remains unclear.

Two Attack Chains, One Goal: SYSTEM Persistence

Check Point Research reconstructed two parallel paths. The first chain begins with a trojanized PDF viewer, SecurityPDF: at least three websites impersonating the company Enveil — some ranked among top search results via SEO manipulation — distributed the software. The viewer checks for the marker "This document is encrypted with sumatrapdf reader!!!!!!!!!!!!" and decrypts the payload with a single-byte XOR key 0x39. From there, it triggers installation of the Troy backdoor.

The second chain, detected in July 2026, starts with fake recruitment messages impersonating Lockheed Martin and Enveil. The target is lured into downloading a purported PDF application that loads libmupdf.dll via DLL sideloading. This launches the MISTPEN downloader, which communicates with its command-and-control server through Microsoft Graph API and OneDrive, blending into legitimate enterprise traffic.

MISTPEN loads four modules: GetInfoPlugin, PvPlugin, OneScreenCapture, and an LPE loader that uses ML-KEM for post-quantum key encapsulation. At this point CVE-2026-68820 triggers escalation to SYSTEM, followed by installation of FudModule 3.1 and the ForestTiger backdoor.

Troy, the backdoor documented for the first time in this campaign, supports 17 distinct commands: file enumeration, upload/download, archiving and exfiltration, interactive shell, process termination, in-memory DLL injection, and configuration updates. The dossier does not specify whether Troy and ForestTiger operate alternately or in conjunction on the same targets.

FudModule 3.1: The Evolution of Kernel-Mode Armor

The third generation of the FudModule rootkit represents a leap over previous versions observed since 2022. The module disables 94 ETW (Event Tracing for Windows) providers, minifilter drivers, and callbacks on objects and the registry.

The most significant novelty is tampering with Windows Smart App Control: as documented by Check Point, "its remote stub sets VerifiedAndReputablePolicyState to zero and invokes NtSetSystemInformation class 0xA4 with option 0x10000000, triggering an in-place reload of the code integrity policy." The rootkit forces the system to reload the code integrity policy with a zeroed reputation condition.

The command-and-control infrastructure relies on compromised WordPress, SharePoint, and Roundcube servers. The Roundcube servers were breached by exploiting CVE-2025-49113, a PHP deserialization vulnerability with CVSS 9.9, to install the RelayShell web shell. Check Point observed at least 17 unique RelayShell server identifiers; operators connect through commercial VPN services. At least one France-based organization, already compromised, was used to send further spear-phishing to other victims.

The CVSS 7.0 Trap: When the Score Masks the Risk

"This CVE carries a CVSS 7.0, rated Important. In the same August Patch Tuesday there are 42 Critical patches. If a vulnerability-management program triages by severity score, this one ends up mid-queue behind RCE bugs nobody has exploited yet. That's exactly the opposite of what's needed."
— Denis Calderone, CTO of Suzu Labs

Calderone's view, reported by SC World, highlights a structural problem: CVSS measures technical severity, not current threat. A bug with AC:H and PR:L, requiring a race-condition win and local access, deserves 7.0. But when that same bug is already in use by Lazarus — a group with a track record of at least three other Windows driver zero-days since 2022 for FudModule — the score becomes a lifeline for attackers.

As Calderone notes, Lazarus's previous strategy was bring-your-own-vulnerable-driver: load a signed but flawed third-party driver, exploit it, gain kernel privileges. Defenders responded with allowlisting. Lazarus adapted by finding bugs in drivers that Windows ships by default. AFD.sys handles every socket operation on every Windows machine. It cannot be blocklisted.

What to Do Now

The following recommendations are inferred from cited expert guidance, not directives from the original brief. Organizations should:

Apply the August 11, 2026 patch immediately for CVE-2026-68820, regardless of CVSS score, given confirmed active exploitation by a documented APT.
Revisit software verification procedures: verify downloads through official channels rather than search rankings, as recommended by Check Point's Shykevich.
Revise triage criteria: integrate threat-actor provenance and KEV/CISA status into patching priorities, not rely solely on CVSS severity.
Extend zero-trust to seemingly legitimate sites: the campaign demonstrated that trust, branding, and SEO positioning can be forged.
Monitor traffic to Microsoft Graph API and OneDrive for anomalies in MISTPEN behavior, which abuses legitimate infrastructure for C2.

Check Point has released indicators of compromise, YARA rules, and full technical details in the original report. Information has been verified against cited sources — Check Point Research, Microsoft MSRC, NIST NVD, CISA KEV — and is current as of publication.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references