Check Point Research published its analysis of a new wave of the Operation Dream Job campaign on August 11, 2026, attributed to the North Korea-affiliated Lazarus group. The threat actor exploited CVE-2026-68820, a local privilege escalation zero-day in the Windows AFD.sys driver, to install the FudModule rootkit with SYSTEM privileges. The campaign targeted the defense sector in Europe and India, using fake job offers and a trojanized PDF viewer distributed through SEO-optimized websites.
- On August 11, 2026, Microsoft released the patch for CVE-2026-68820, a zero-day LPE in the AFD.sys driver, following responsible disclosure by Check Point Research.
- Lazarus distributed SecurityPDF, a viewer based on MuPDF, which checks for the marker "This document is encrypted with sumatrapdf reader!!!!!!!!!!!!" and extracts the payload with XOR key 0x39.
- At least three websites impersonate the company Enveil, with some ranked as the top search result for queries related to SecurityPDF.
- Two parallel infection chains were identified: SecurityPDF → Troy and DLL sideloading with libmupdf.dll → MISTPEN → ForestTiger.
How the SecurityPDF Infection Chain Works
The 2026 variant of Operation Dream Job begins with the distribution of SecurityPDF, a modified PDF viewer based on the open-source MuPDF code. The executable, offered to victims to open purported job offer documents in the defense and aerospace sectors, contains a specific activation logic: it verifies the presence of the marker "This document is encrypted with sumatrapdf reader!!!!!!!!!!!!" inside the crafted PDF, then extracts an encrypted payload using a single-byte XOR key 0x39, writes it to %TEMP%\new.exe, and executes it.
The extracted payload is the new Troy backdoor, which initiates the actual compromise. In parallel, Check Point documented a second infection chain that leverages DLL sideloading via libmupdf.dll, leading to the MISTPEN downloader — documented in 2024 by Mandiant — which uses Microsoft Graph API and OneDrive for command and control with AES encryption. From MISTPEN, the chain proceeds to the ForestTiger backdoor, consolidating persistent access.
From Troy to FudModule: Escalation with CVE-2026-68820
After the initial reconnaissance and persistence phase, Lazarus exploited CVE-2026-68820 to elevate privileges to the kernel level. The vulnerability resides in the Windows AFD.sys (Ancillary Function Driver), the component responsible for managing network sockets. The exploit allowed the deployment of a new version of FudModule, the group's kernel-mode rootkit, which operates with SYSTEM privileges and bypasses endpoint protection mechanisms.
Check Point reported the vulnerability to Microsoft through responsible disclosure. The vendor assigned the identifier CVE-2026-68820 and released the patch on August 11, 2026, as part of the monthly August Patch Tuesday updates. The assigned CVSS score is 7, with a HIGH severity classification.
SEO and Compromised Sites as Distribution Vectors
A distinctive element of the 2026 campaign is the use of search engine optimization techniques to distribute malware. Check Point identified at least three websites impersonating the company Enveil, some of which are positioned as the top search result for queries such as "Enveil SecurityPDF." The source specifies that the attacker impersonates Enveil without the company itself having been compromised or targeted.
In parallel, Lazarus exploited CVE-2025-49113 — a high-severity vulnerability with a CVSS of 9.9 according to authoritative sources — to compromise Roundcube servers, installing the PHP RelayShell webshell. These servers were used as relays for command and control, leveraging third-party infrastructure to mask communications. At least one compromised European organization was subsequently abused for spear-phishing toward further victims, leveraging the reputation of the first.
"Microsoft assigned the vulnerability CVE-2026-68820 and released a patch on August 11, 2026, as part of their August Patch Tuesday updates" — Check Point Research
The Evolution of a Campaign Running Since 2020
The term Operation Dream Job was coined by ClearSky in 2020, when the Lazarus group was first observed using trojanized PDF viewers in combination with fake job offers. ESET confirmed the campaign's continuity in 2025, with targeting of European UAV sector companies and the use of overlapping techniques: trojanization of open-source projects, social engineering through job lures, and the ScoringMathTea payload. ESET attributes the activity with high confidence to Lazarus, specifically to campaigns correlated to Operation DreamJob.
The 2026 wave documented by Check Point represents a significant technical escalation: the introduction of a Windows kernel zero-day, the dual-use of legitimate APIs (Microsoft Graph, OneDrive) for evasion, and the employment of SEO to amplify lure credibility. It is no longer just social engineering: it is an artificially constructed trust supply chain.
Why It Matters
The dossier does not specify the exact method of initial victim contact in the 2026 campaign — whether via LinkedIn, messaging applications, or email — nor the full geographic extent beyond Europe and India. The total number of compromised organizations is not quantified, and the exact role of CVE-2025-60719 (Microsoft advisory on the same AFD.sys driver) relative to the 2026 zero-day is not clarified by the primary source.
The source does not document specific remedial measures adopted by victims nor interventions by Enveil against the impersonation. The brief does not list operational best practices, recommended detection tools, or hardening procedures. What emerges clearly is the convergence of refined social engineering techniques and kernel-level exploitation capabilities, with legitimate tools transformed into evasion components.
The campaign demonstrates that the defense and aerospace sector remains a priority target for North Korean APTs, and that lure credibility no longer depends solely on message quality, but on the construction of an entire distribution ecosystem — websites, SEO, modified open-source software — that makes the attack indistinguishable from a legitimate interaction until the moment of kernel execution.
FAQ
- Are CVE-2025-60719 and CVE-2026-68820 the same vulnerability?
- The dossier does not establish this link. CVE-2025-60719 is a Microsoft advisory on the same AFD.sys component, but the CVE relevant to the 2026 campaign is CVE-2026-68820, documented exclusively by Check Point.
- Was Enveil compromised?
- No. Check Point explicitly specifies that the attacker impersonates Enveil without indications that the company was targeted or compromised.
- When was the patch released?
- Microsoft released the patch for CVE-2026-68820 on August 11, 2026, as part of the August Patch Tuesday updates.
Sources
- https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/
- https://www.welivesecurity.com/en/eset-research/gotta-fly-lazarus-targets-uav-sector/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60719
- https://www.clearskysec.com/operation-dream-job/
Information is based on the cited source and current as of publication.