The North Korean menace actor generally known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched safety flaw impacting Microsoft Home windows to ship a never-before-seen backdoor focusing on protection and aerospace corporations throughout France, Germany, Brazil, and India.
The exercise, per Test Level Analysis, is a part of Operation Dream Job, a long-running cyber espionage and social engineering marketing campaign orchestrated by Pyongyang-backed hackers to focus on professionals worldwide with fake-but-compelling job presents at companies like Lockheed Martin and Enveil to steal delicate knowledge and set up malware by approaching them on platforms like LinkedIn, pretending to be recruiters in an try and construct belief.
The assaults have been discovered to use CVE-2026-68820 (CVSS rating: 7.0), a privilege escalation flaw affecting Home windows Ancillary Perform Driver for WinSock (“AFD.sys”) that was patched by Microsoft as a part of its Patch Tuesday updates for August 2026.
Test Level Analysis instructed The Hacker Information that it reported the vulnerability to Microsoft in late July 2026, though it mentioned “we’re accustomed to a profitable implementation of the CVE to start with of June.”
As noticed in prior marketing campaign waves, victims are lured by means of bogus recruiter messages and tricked into opening a malicious PDF or putting in a trojanized PDF viewer, which is then used to put in a brand new backdoor known as Troy that grants distant entry to the compromised machine. The tip aim of those intrusions is to grab full management of contaminated computer systems and bypass safety controls.
The usage of a trojanized PDF viewer is a tried-and-tested tactic adopted by the Lazarus Group at the side of Dream Job, with the menace actors abusing this methodology way back to 2022.
Two totally different parallel an infection sequences have been detected as a part of the newest assaults –
- DLL side-loading, by which victims are instructed to obtain an encrypted archive that is used to set off a DLL side-loading chain. The malicious DLL (“libmupdf.dll”) is used to show a bogus job description lure, whereas it stealthily downloads and executes in reminiscence a light-weight downloader dubbed MISTPEN. The downloader communicates with menace actor-controlled infrastructure utilizing Microsoft Graph API and OneDrive to retrieve and run reconnaissance and persistence modules and set off the “AFD.sys” driver exploit, earlier than deploying ForestTiger (aka ScoringMathTea), which offers distant entry to the host.
- Trojanized “SecurityPDF” PDF viewer, by which victims are instructed to obtain SecurityPDF from an internet site impersonating Enveil. As soon as put in, it screens for any PDF doc opened by means of it for a particular marker (“This doc is encrypted with sumatrapdf reader!!!!!!!!!!!!”). If such a marker is current, the applying decrypts and launches an embedded payload that is liable for loading a backdoor known as Troy immediately into reminiscence. The DLL implant helps 17 operator instructions to facilitate file enumeration, add and obtain, archive and exfiltration, interactive shell entry, course of termination, in-memory DLL injection, and configuration updates.
 |
| Excessive-level overview of the DLL sideloading an infection chain. |
MISTPEN, for its half, hundreds a minimum of 4 totally different modules –
- GetInfoPlugin (“Release_GetInfoPlugin_x64.dll”), to profile the host and exfiltrate the collected info as a single wide-character string
- PvPlugin (“Release_PvPlugin_x64.dll”), to gather host reconnaissance knowledge and particulars about operating processes
- OneScreenCapture (“OneScreenCapture64.dll”), to take screenshots of the present desktop, together with all screens, and transmit them as JPEG photos
- LPE (native privilege escalation) loader, which gathers host info, generates new key materials utilizing the ML-KEM post-quantum key encapsulation algorithm, and makes use of the negotiated key in the course of the handshake course of to decrypt and run FudModule.
The assault chain employs an up to date model of the recognized kernel-mode rootkit the Lazarus Group has repeatedly employed since a minimum of 2022 to hide the presence of malicious instruments from safety software program put in on the host.
 |
| Considered one of web sites that rank extremely in search engine outcomes for “Enveil SecurityPDF” |
Particularly, it exploits a neighborhood privilege escalation vulnerability in “AFD.sys,” obtains SYSTEM privileges, and finally injects one other occasion of MISTPEN right into a SYSTEM course of in order to permit it to run with elevated privileges and away from the eyes of safety instruments. The newer model, known as FudModule 3.1, improves upon its predecessor by permitting it to tamper with a Home windows function known as Good App Management designed to confirm if a program is protected to run.
“Throughout the SYSTEM-level msiexec.exe youngster course of, its distant stub units VerifiedAndReputablePolicyState to zero and invokes NtSetSystemInformation class 0xA4 with possibility 0x10000000, triggering an in-place reload of the code integrity coverage,” Test Level mentioned.
What’s extra, the attackers are mentioned to have created a minimum of three web sites impersonating Enveil to distribute “SecurityPDF,” though it is unclear how these pretend portals have been included into the social engineering marketing campaign. It is suspected that the adversary first sends the PDF by means of a phishing message after which urges them to obtain the PDF viewer from the positioning to view the doc.
The domains are listed under –
- envell[.]xyz
- enveil[.]on-line
- uxtramine[.]org
What’s notable is that the marketing campaign, as a substitute of spinning up its personal bespoke infrastructure, hijacks authentic however compromised WordPress and SharePoint web sites and susceptible Roundcube webmail servers to be used as ForestTiger command-and-control (C2) servers, thereby making it much more difficult to distinguish it from regular internet site visitors.
Lots of the Roundcube servers have been discovered to be susceptible to CVE-2025-49113, with the attackers leveraging it to contaminate them with a beforehand undocumented PHP internet shell codenamed RelayShell to allow the alternate of instructions and responses within the type of textual content recordsdata. In a minimum of one case, an already breached France-based group was used to ship phishing messages to new victims to bypass reputation-based filters.
The newest findings present that Lazarus Group continues to hone its malware capabilities and tradecraft, whereas preserving the foundations of Dream Job largely intact in assaults aimed toward vital sectors internationally.
“What makes this marketing campaign so harmful will not be solely the zero-day vulnerability – but additionally how Lazarus wove authentic, trusted infrastructure into each stage of the assault,” Sergey Shykevich, director of menace intelligence at Test Level Software program, mentioned in an announcement shared with The Hacker Information. “They hid in plain sight, behind top-ranked search outcomes, actual vendor branding, and the status of organizations they’d already compromised.
“When the web site, the obtain and the recruiter all seem genuine, the previous recommendation to ‘spot the phishing hyperlink’ is not simply relevant. Staying protected now means assuming that belief itself may be counterfeited: patch the second updates land, confirm software program by means of official channels reasonably than search rankings, and lengthen zero-trust considering to the legitimate-looking websites and companions we work together with each day.”
