Full Report
The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security flaw impacting Microsoft Windows to deliver a never-before-seen backdoor targeting defense and aerospace companies across France, Germany, Brazil, and India. The activity, per Check Point Research, is part of Operation Dream Job, a long-running cyber espionage and
Analysis Summary
# Threat Actor: Lazarus Group
## Attribution & Identity
- **Actor Name:** Lazarus Group
- **Country of Origin:** North Korea (Pyongyang-backed)
- **Known Aliases:** HIDDEN COBRA (associated/attributed by other sources), APT38.
- **Associated Groups:** Affiliated with the Reconnaissance General Bureau (RGB).
## Activity Summary
The actor is currently executing a new wave of **Operation Dream Job**, a long-running cyber espionage campaign. The latest activity involves the exploitation of a zero-day vulnerability in the Windows Ancillary Function Driver (AFD.sys) to gain SYSTEM-level privileges. The campaign uses social engineering—specifically fake job offers—to deliver never-before-seen backdoors and rootkits to high-value targets.
## Tactics, Techniques & Procedures
- **Social Engineering:** Approaching professionals on LinkedIn with fake job opportunities at firms like Lockheed Martin and Enveil.
- **Zero-Day Exploitation:** Exploiting **CVE-2026-68820** (CVSS: 7.0) in `AFD.sys` for Local Privilege Escalation (LPE).
- **DLL Side-Loading:** Utilizing malicious `libmupdf.dll` to trigger infection chains.
- **Trojanized Software:** Distributing a malicious version of "SecurityPDF" viewer to decrypt and launch embedded payloads.
- **In-Memory Execution:** Loading backdoors like "Troy" directly into memory to evade disk-based detection.
- **Post-Quantum Cryptography:** Using the ML-KEM algorithm for key encapsulation during the handshake process for its LPE loader.
- **Cloud Service Abuse:** Using Microsoft Graph API and OneDrive for Command and Control (C2) communication.
## Targeting
- **Sectors:** Defense, Aerospace, Energy, and Nuclear.
- **Geography:** France, Germany, Brazil, and India.
- **Victims:** Professionals at defense-related organizations (e.g., targets impersonating recruiters from Lockheed Martin).
## Tools & Infrastructure
- **Malware Families:**
- **Troy:** A new backdoor supporting 17 commands (file exfiltration, shell access, DLL injection).
- **MISTPEN:** A lightweight downloader and reconnaissance tool.
- **ForestTiger (aka ScoringMathTea):** A remote access trojan (RAT).
- **FudModule:** A known kernel-mode rootkit used for defense evasion.
- **Plugins:** GetInfoPlugin, PvPlugin, and OneScreenCapture (screenshot utility).
- **Infrastructure:**
- **C2:** Microsoft OneDrive via Graph API.
- **Domains/Lures:** `enveil[.]com` (impersonated), malicious job-themed PDF files.
## Implications
Lazarus Group remains one of the most sophisticated state-sponsored threats, demonstrating the capability to acquire and weaponize zero-day vulnerabilities. By targeting defense and aerospace sectors, the group seeks to steal highly sensitive military and technological intellectual property to advance North Korea's strategic interests. Their use of post-quantum algorithms and in-memory backdoors indicates a high level of technical evolution designed to bypass modern EDR and NDR solutions.
## Mitigations
- **Patch Management:** Immediately apply Microsoft’s August 2026 security updates to address **CVE-2026-68820**.
- **User Training:** Educate employees, especially in HR and Engineering, on the risks of unsolicited job offers on LinkedIn and the dangers of downloading PDF viewers from unofficial sources.
- **App Whitelisting:** Restrict the installation of PDF readers to approved enterprise software (e.g., Adobe Acrobat or Nitro).
- **Behavioral Monitoring:** Monitor for unusual DLL side-loading activity in common productivity applications and unauthorized use of Microsoft Graph API for external data transfer.