Operation Dream Job Wave 3: Lazarus Group's Zero-Day Exploit Chain Against Defense Engineers

Executive Summary

Check Point Research published findings on August 17, 2026 documenting a new wave of Lazarus Group operations (designated "Operation Dream Job Wave 3") that combines social engineering against defense industry professionals with a novel exploitation chain built around an unpatched Windows kernel zero-day (CVE-2026-68820) and FudModule v3.1, an upgraded kernel-mode rootkit designed to strip EDR telemetry entirely.

Lazarus has been exploiting this flaw since at least early July 2026 (a 5-to-6-week window before Microsoft shipped the Patch Tuesday fix on August 11). During that gap, every Windows endpoint running build 24H2 (26100) or later in the targeted environment was fully accessible to the group at SYSTEM privilege level.

The attack uses two parallel infection paths:

• Chain 1: DLL side-loading via a signed PDF viewer bundled with a malicious libmupdf.dll, deploying MISTPEN → FudModule v3.1 exploit chain ending in ForestTiger backdoor.
• Chain 2: Trojanized SecurityPDF.exe distributed through SEO-poisoned impersonator websites that look like a real privacy-tech company, running the Troy backdoor in memory via reflective DLL injection.

Campaign Overview: From Fake Job Offer to SYSTEM Privilege

Lazarus targets defense engineers (drone makers, aerospace contractors, military suppliers) with fake recruitment offers from companies they impersonate (Lockheed Martin, Enveil). Initial contact occurs via LinkedIn or messaging apps; Check Point could not confirm the exact outreach vector.

The operator uses SEO poisoning to make their impersonator sites rank above legitimate ones for search queries like "Enveil SecurityPDF", a novel distribution technique that turns search engines into delivery infrastructure without requiring a phishing click from the victim. Three confirmed domains impersonate Enveil: envell[.]xyz, enveil[.]online, and uxtramine[.]org (backed by IPs 135.181.67.203 and 135.181.185.158).

Check Point also confirmed Sweden as a heightened focus alongside Denmark and Portugal for Iran-linked Dream Job campaign activity (Nimbus Manticore), with defense manufacturing, telecoms, and aviation in scope, the same sector profile Lazarus targets today under Wave 3 operations covering France, Germany, India, Brazil.

Infection Chain 1: DLL Sideloading (ZIP → Malicious DLL → Rootkit)

Phishing lure → Encrypted ZIP (signed PDF viewer + libmupdf.dll + decoy PDF)
→ DLL search-order sideload of malicious libmupdf.dll by legitimate viewer
→ MISTPEN in-memory downloader activates via reflective PE load
→ GetInfoPlugin / PvPlugin host recon, OneScreenCapture screenshot
→ LPE loader communicates with FudModule via GOST-CBC encrypted RPC buffer
→ Kyber/ML-KEM post-quantum key exchange → download of AFD.sys exploit module
→ CVE-2026-68820 exploited → SYSTEM privileges → ForestTiger backdoor established

Key technical notes:

The DLL sideloading relies on the legitimate PDF viewer's search-order loading behavior because Windows searches current directory first, so placing a malicious libmupdf.dll adjacent to the signed executable causes the OS to load it. The decoy job-description PDF displays normally while the malicious DLL executes in memory simultaneously. This is Chain 1 and accounts for 12 observed dropper samples, 9 MISTPEN binaries, and 5 ForestTiger implants.

MISTPEN communicates via Microsoft Graph API through attacker-controlled OneDrive files, mimicking legitimate cloud-sync traffic to evade network detection. All uploads are AES-encrypted with per-direction keys. The LPE stage uses GOST-CBC encryption with a 16-byte session key (prepended to packets), and performs post-quantum Kyber/ML-KEM key exchange before downloading the FudModule exploit binary.

Infection Chain 2: Trojanized PDF Viewer + Troy Backdoor

Phishing lure → Fraudulent Enveil recruiter offer → Download trojanized SecurityPDF.exe OR visit impersonator site
→ Open crafted PDF with SecurityPDF viewer
→ Viewer detects marker string "This document is encrypted with sumatrapdf reader!!!!!!!!!!!!"
→ XOR decrypt (key 0x39) embedded payload into %TEMP%\new.exe
→ Reflective DLL load of Troy backdoor — no disk artifact beyond new.exe

Troy backdoor capabilities include 17 operator commands covering file enumeration (LIST), process listing via WMI (pvd), PowerShell-compressed archives for exfiltration (ZIPDOWNLOAD), and reflective DLL injection into remote processes (mem). C2 uses plain HTTP on port 80 with CONNECTED validation handshake, Base64-encoded tasking with JSON response envelopes, and chunked delivery for large transfers.

Detection indicator: The marker string is unique to this wave's trojanized viewer. Any PDF opened in a real MuPDF-based reader will not contain it. The PDB path E:\HK\Tool_Module\Troy_Handle\1Troy_Create_Dll_Tool\x64\Release\Test_Dll.pdb appears in compiled Troy binaries and links to prior ESET-documented Lazarus sample infrastructure.

FudModule v3.1 (The Kernel Rootkit Layer)

FudModule v3.1 is the most technically sophisticated component of this wave. It runs as a kernel driver (Afd4Eop12_x64.dll, compiled July 7, 2026) and performs:

• ETW kill-list: disables telemetry by killing NT Kernel Logger and blinding 90+ Event Trace for Windows providers (identical GUIDs to those in Gen Digital's 2024 FudModule v3 report).
• Process/thread/image notify callback removal: strips the kernel hooks that EDR products use to observe process creation, DLL loads, and thread execution.
• WFP stage targeting: disables Kaspersky's Windows Filter Platform integration; Symantec absence noted (suggesting selective targeting by Defender vendor).
• Crash-dump suppression: prevents BSOD memory dumps from being written.
• Smart App Control tampering: sets VerifiedAndReputablePolicyState=0 and calls NtSetSystemInformation class 0xA4 option 0x10000000 to reload code integrity policy, effectively whitelisting the rootkit's own operations.
• Privileged handle forgery: fakes kernel handles used by security software for access decisions.

FudModule v3.1 also introduces a two-hop execution model: after initial SYSTEM privilege via CVE-2026-68820, it spawns through services.exe into a SYSTEM-owned msiexec.exe, from which it injects a second MISTPEN instance, making process-tree analysis harder because the parent appears legitimate.

FudModule v3.1 compared to FudModule v3 (Gen Digital 2024): adds Smart App Control tampering; removes dedicated Defender-suspension stage (SuspendDefender string orphaned as a log). It now requires Windows 11 build 26100+ (24H2) or 26200 (25H2); older builds are out of scope.

CVE-2026-68820: AFD.sys Zero-Day Analysis

CVE-2026-68820 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys), rated CVSS 7.0 HIGH (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). It triggers when multiple threads concurrently access new-socket state during creation; one path frees memory while another still references it, yielding a kernel read/write primitive.

Timeline:

BOD 26-04 requires internal systems patched by August 25. The fix is mandatory reboot. Installing the patch without restarting leaves endpoints fully exposed, since AFD.sys is a kernel driver replaced only on next boot.

Check Point intentionally withheld full exploit details during the remediation window to reduce immediate reproduction; a Chinese-language PoC appeared on Aug 9 but Microsoft did not officially acknowledge it as publicly disclosed.

Why AFD.sys keeps getting targeted: It ships on every modern Windows installation, runs in Ring 0, and is reachable from any low-privilege account. This is the fourth confirmed AFD.sys zero-day attributed to Lazarus since 2022 (previous: CVE-2024-38193).

SEO Poisoning as a Delivery Vector

Operation Dream Job Wave 3's impersonator sites (envell[.]xyz, enveil[.]online, uxtramine[.]org) are deliberately optimized to rank at the top of search results for relevant queries, effectively turning Google/Bing into an unwitting distribution partner. Operators access RelayShell relay nodes through shared VPN services (ExpressVPN observed).

Detection point: Defenders should audit outbound traffic from internal workstations to impersonator domains, monitor first-time downloads of PDF viewer binaries not sourced from the vendor's official channel, and flag TLS SNI patterns matching known Lazarus infrastructure (135.181.x.x /24 blocks).

Detection Guidance for Defenders, SMB Staff & Windows Operators

For SOC/Defender teams:

• Monitor NtSetSystemInformation class 0xA4 calls from SYSTEM processes, especially from child processes of services.exe or msiexec.exe. This is the Smart App Control tampering indicator in FudModule v3.1.
• Alert on %TEMP%\new.exe creation followed by DLL reflective loads via RtlCreateUserThread (no matching PE file on disk).
• Monitor ETW session IDs: kill-list detection should compare active trace providers against the known 94 GUID set from FudModule v3/v3.1. Any match warrants immediate investigation regardless of "normal" appearance.
• YARA rule lazarus_relayshell: scan web-server file roots for compromised Roundcube/WordPress/PrestaShop instances. Requires minimum 3 of the embedded cipher strings to trigger.

For SMB/IT staff:

• Patch immediately: KB5121003 (Win 11) / KB5120249 (Win 10 ESDU). Reboot required. Patching without reboot leaves endpoints fully exposed.
• Audit startup applications and legitimate PDF reader binaries for unexpected libmupdf.dll in adjacent directories.
• Verify TLS certificates on any "security PDF" viewer download that wasn't sourced from the official publisher website.
• Block outbound HTTP to port 80 from workstations unless explicitly required. Troy backdoor communicates exclusively over plain HTTP with CONNECTED validation string.

For Windows operators (individual users):

• If you receive a "job offer" email or LinkedIn message offering work in defense/aerospace and it asks you to download a PDF viewer, do not open it. Legitimate recruiters do not distribute custom-built PDF viewers via phishing attachments.
• A suspicious ZIP containing both a PDF document AND a DLL is almost certainly malicious. Legitimate documents do not bundle executable sidecars.
• Any "SecurityPDF" or similarly named reader you haven't installed yourself is suspect, especially if it appeared in response to a job-offer email.

Key IOCs (Summary)

File hashes (SHA-256, selected from 40+ published by Check Point):

DLL Dropper:    2b4987c07a3d9a9a5d1a9bf4efa3d1903e775090b611710edafdc92874265ca8
MISTPEN:        2db25ac41a66aa523c79e23e00443573530dd7bd82b8371bcc87bd7232e141eb
ForestTiger:    72dccae85e062f541fecad9ec7a18a3123e7ae5ac5d53c91709b53a46dbbd289
FudModule:      3b6378df8442e63a6ed7317075913e4720847a510d95022d4a8347b2637c245d
SecurityPDF.exe: 743172aab606974b054a64561534ae66baa3a840657f79d7c6fa18350e8d45d1
Troy Backdoor:  590fb6ae19480d694e08ee85859cad8066f2f87e7e5abba2960c6d115e1615d6
RelayShell:     21c3ad4838c4324bc5f081021da5fb2e9073d0c9304087811c21eb47c9e22762

Impersonator infrastructure:

• Domains: envell[.]xyz, enveil[.]online, uxtramine[.]org
• IPs: 135.181.67.203, 135.181.185.158

Troy backdoor marker:

• String embedded in crafted PDFs: "This document is encrypted with sumatrapdf reader!!!!!!!!!!!!" (if present → trojanized viewer; if absent → legitimate MuPDF)

Sources

1. Check Point Research, "Shattering the Dream" (Aug 17, 2026): https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack
2. MSRC CVE-2026-68820: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820
3. CISA KEV entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-68820
4. SOC Prime analysis (Aug 12): https://socprime.com/blog/cve-2026-68820-actively-exploited-windows
5. Hard2bit operational breakdown: https://hard2bit.com/en/blog/lazarus-dream-job-zero-day-afd-fudmodule-defence
6. Qualys KEV+BOD guidance (Aug 18): https://blog.qualys.com/product-tech/2026/08/18/cve-2026-68820-kev-bod-26-04-requirements