Key Takeaways
- Lazarus Group’s “Operation Dream Job” uses fake recruiter offers on LinkedIn to lure professionals in defense, aerospace, and related sectors.
- The campaign exploits a newly patched Windows privilege‑escalation flaw (CVE‑2026‑68820, CVSS 7.0) in the AFD.sys driver to gain SYSTEM privileges.
- Attackers deliver malware via two parallel chains: a DLL‑side‑loading sequence that drops the MISTPEN downloader, and a trojanized “SecurityPDF” viewer that launches the Troy backdoor when a specific marker is present in a PDF.
- MISTPEN loads reconnaissance, screenshot, and local‑privilege‑escalation modules, ultimately deploying the updated FudModule 3.1 rootkit to evade Smart App Control and hide malicious activity.
- The threat actors hijack legitimate but compromised WordPress, SharePoint, and Roundcube servers (including those vulnerable to CVE‑2025‑49113) as command‑and‑control infrastructure, blending malicious traffic with normal web usage.
- Defense recommendations include prompt patching, verifying software from official sources, applying zero‑trust principles to trusted‑looking sites, and monitoring for abnormal use of legitimate services.
Overview of Lazarus Group and Operation Dream Job
The North Korean‑linked Lazarus Group continues its long‑running espionage campaign dubbed Operation Dream Job, which focuses on professionals working for defense and aerospace firms such as Lockheed Martin and Enveil. By masquerading as recruiters on platforms like LinkedIn, the attackers send convincing but fraudulent job offers that entice targets to click links or download attachments. This social‑engineering approach has proven effective for years, allowing the group to establish initial contact with high‑value individuals while appearing legitimate. The campaign’s core objective remains the theft of sensitive data and the installation of persistent backdoors that grant remote control over compromised systems.
Exploit Details: CVE‑2026-68820 and the AFD.sys Driver
A critical component of the latest wave is the exploitation of CVE‑2026-68820, a privilege‑escalation vulnerability affecting the Windows Ancillary Function Driver for WinSock (AFD.sys). Microsoft assigned this flaw a CVSS score of 7.0 and patched it during the August 2026 Patch Tuesday release. The vulnerability enables attackers with low privileges to escalate to SYSTEM level by triggering a specific code path in the driver. Once SYSTEM access is obtained, the malware can modify core Windows security mechanisms, install kernel‑mode rootkits, and operate with minimal visibility to endpoint protection tools.
Social Engineering Tactics: Fake Recruiter Messages
The attackers begin each operation with a carefully crafted LinkedIn message that pretends to originate from a recruiter at a reputable company. The message typically includes a personalized greeting, references to the victim’s background, and an attached PDF purportedly containing a job description or project details. By leveraging the trust associated with professional networking sites, the threat actors reduce the likelihood that recipients will scrutinize the attachment. In many cases, the PDF is either malicious itself or serves as a lure that prompts the victim to download a secondary, seemingly benign application.
Trojanized PDF Viewer and Malicious PDF Delivery
Two distinct payload delivery methods have been observed. In the first, victims receive a malicious PDF that, when opened, executes embedded code to drop a trojanized PDF viewer. In the second, the attackers direct targets to download a fake “SecurityPDF” application from websites impersonating Enveil. The viewer remains dormant until it encounters a PDF containing the marker string “This document is encrypted with sumatrapdf reader!!!!!!!!!!!!”. Upon detection, the viewer decrypts and launches an embedded backdoor called Troy directly into memory, bypassing traditional file‑based scanning.
DLL Side‑Loading Infection Chain
The parallel infection chain relies on DLL side‑loading. Victims are instructed to download an encrypted archive that, when extracted, contains a legitimate‑looking PDF and a malicious DLL named libmupdf.dll. Execution of libmupdf.dll displays a bogus job description while silently launching a lightweight downloader termed MISTPEN in memory. MISTPEN then contacts attacker‑controlled infrastructure via Microsoft Graph API and OneDrive to retrieve additional modules, conduct reconnaissance, and ultimately trigger the AFD.sys exploit to deploy the ForestTiger (aka ScoringMathTea) backdoor, granting the attacker full remote access.
MISTPEN Modules and Their Functions
MISTPEN is a modular loader that activates at least four distinct components:
- GetInfoPlugin collects system information and exfiltrates it as a wide‑character string.
- PvPlugin gathers detailed reconnaissance data, including running processes and host configuration.
- OneScreenCapture captures screenshots of all connected monitors and transmits them as JPEG images.
- LPE loader performs local privilege escalation, generates new key material using the ML‑KEM post‑quantum key encapsulation algorithm, and uses the negotiated key to decrypt and execute the FudModule rootkit.
These modules work together to profile the victim, maintain stealth, and prepare the system for deeper infiltration.
SecurityPDF Viewer and the Troy Backdoor
The trojanized SecurityPDF viewer operates as a stealthy delivery mechanism for the Troy backdoor. After installation, the viewer monitors every PDF opened through it for the unique encryption marker. When the marker is present, the viewer decrypts an embedded payload and loads Troy directly into memory. Troy supports 17 operator commands that enable file enumeration, upload/download, archiving, exfiltration, interactive shell access, process termination, in‑memory DLL injection, and configuration updates. This rich command set allows attackers to adaptively navigate the compromised environment and exfiltrate high‑value data without writing detectable files to disk.
Privilege Escalation and FudModule 3.1 Rootkit
Once SYSTEM privileges are secured via the AFD.sys exploit, the attackers deploy an updated version of their kernel‑mode rootkit, FudModule 3.1. This rootkit not only hides malicious processes and files from security software but also tampers with Windows Smart App Control. By setting the VerifiedAndReputablePolicyState to zero and invoking NtSetSystemInformation with a specific option, the malware forces an in‑place reload of the code integrity policy, thereby allowing unsigned or malicious code to execute with trusted status. The rootkit’s ability to inject a second instance of MISTPEN into a SYSTEM process (such as msiexec.exe) further isolates the malicious activity from user‑space defenses.
Abuse of Legitimate Infrastructure
Rather than building dedicated command‑and‑control servers, Lazarus Group hijacks already compromised but trusted web assets. The attackers have taken over vulnerable WordPress and SharePoint sites, as well as Roundcube webmail servers exposed through CVE‑2025-49113, to host ForestTiger C2 endpoints. On at least one breached French organization, the compromised Roundcube server was used to send phishing messages to new victims, leveraging the sender’s reputation to evade email filters. Additionally, the group has installed a previously undocumented PHP web shell dubbed RelayShell on these servers, enabling command exchange via simple text files. This strategy blends malicious traffic with legitimate web usage, making detection significantly harder.
Conclusion and Defensive Recommendations
The latest Operation Dream Job wave illustrates how Lazarus Group continues to refine its tactics, combining zero‑day exploits, sophisticated social engineering, modular malware, and the abuse of trusted infrastructure. To mitigate such threats, organizations should prioritize immediate application of security patches, especially for privilege‑escalation flaws like CVE‑2026-68820. Software and updates must be obtained exclusively from official vendor channels rather than third‑party search results. Adopting a zero‑trust mindset—verifying the authenticity of websites, emails, and download sources even when they appear legitimate—is essential. Monitoring for anomalous use of legitimate services (e.g., unexpected Microsoft Graph API traffic, unusual OneDrive file accesses, or irregular Roundcube activity) can help uncover hidden C2 channels. Finally, regular security awareness training that emphasizes the evolving nature of phishing and recruiter‑lure tactics will reduce the likelihood of successful initial compromise.