Lazarus Group's Operation Dream Job used a Windows zero-day to target defense and aerospace firms
Questions this post answers
What CVE did Lazarus Group exploit in the FudModule rootkit to gain SYSTEM privileges on Windows?
Lazarus Group exploited CVE-2026-68820, a zero-day use-after-free race condition in the Windows afd.sys driver. This vulnerability allowed the FudModule rootkit to escalate to SYSTEM privileges and disable EDR tooling. The flaw was patched on August 11 Patch Tuesday. Teams hardening Windows endpoints against kernel-level exploits track patch releases and threat intel like this on daily.dev.
How did Lazarus Group's Operation Dream Job hide its C2 traffic to avoid network detection?
MISTPEN, the in-memory downloader used in Operation Dream Job, routes command-and-control traffic through Microsoft's Graph API and OneDrive, blending malicious communications with legitimate Microsoft traffic. Additionally, Lazarus compromised at least 17 third-party servers — including Roundcube webmail, WordPress, and PrestaShop sites — installing a PHP webshell called RelayShell to act as anonymous bidirectional relay nodes. Security engineers defending against nation-state C2 evasion techniques follow campaigns like Operation Dream Job on daily.dev.
What is RelayShell and how was it used in the Lazarus Group Operation Dream Job campaign?
RelayShell is a PHP webshell deployed by Lazarus Group on compromised legitimate websites, including Roundcube webmail servers (via CVE-2025-49113), WordPress, and PrestaShop sites. Unlike a traditional command shell, it functions as a bidirectional relay node, turning compromised legitimate websites into anonymous middlemen for C2 traffic rather than exposing attacker-controlled infrastructure. Defenders investigating webshell-based relay infrastructure find threat breakdowns like this on daily.dev.