North Korean threat group Lazarus exploited a Windows zero-day (CVE-2026-68820), a use-after-free in AFD.sys, to gain SYSTEM privileges as part of the Operation Dream Job campaign targeting defense, aerospace, and aviation firms in Europe and India. Microsoft patched the flaw in its August Patch Tuesday update. Check Point found the exploit built into a new FudModule rootkit variant supporting Windows 11 builds 26100 and 26200, plus a new backdoor called Troy and a PHP web shell called RelayShell deployed against vulnerable Roundcube installations via CVE-2025-49113. At least 17 compromised Roundcube servers were identified, with victims spanning France, Germany, and Brazil.
Table of contents
Related Articles:Questions this post answers
What is CVE-2026-68820 and how is it being exploited?
CVE-2026-68820 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys) that lets a locally authenticated user run a specially crafted application to trigger a race condition and gain SYSTEM privileges without user interaction. Microsoft patched it in its August Patch Tuesday update after confirming active exploitation by the Lazarus Group since early July, targeting Windows 11 builds 26100 and 26200. Security teams tracking actively exploited Windows vulnerabilities can follow patch details like this on daily.dev.
How is Lazarus Group using the FudModule rootkit in its latest attacks?
Lazarus incorporated an exploit for the Windows AFD.sys zero-day CVE-2026-68820 into a new version of the FudModule kernel-mode rootkit, giving it privilege escalation on Windows 11 builds 26100 and 26200. The updated rootkit disables EDR telemetry, interferes with security products, and now also tampers with Smart App Control, as part of the Operation Dream Job campaign against defense and aerospace organizations. Track evolving rootkit and EDR-evasion techniques like FudModule's updates on daily.dev.
How are attackers compromising Roundcube servers in the Operation Dream Job campaign?
Attackers likely use leaked credentials to log into Roundcube webmail, then exploit CVE-2025-49113, an authenticated PHP object-deserialization vulnerability, to achieve remote code execution. They deploy a new PHP web shell called RelayShell, with at least 17 infected Roundcube servers identified based on retrieved identifiers, allowing attackers to hide malicious communications inside legitimate web infrastructure. Admins securing Roundcube deployments can stay ahead of exploited CVEs discussed on daily.dev.