A fake job offer, a modified PDF viewer, and a Windows kernel zero-day. That was the whole chain.
Lazarus Group spent roughly five weeks exploiting CVE-2026-68820 — a use-after-free in afd.sys, the driver behind Windows Sockets — against defense, aerospace and aviation targets in Europe and India. Microsoft patched it on August 11 Patch Tuesday. CISA added it to KEV the same day.
WHAT ACTUALLY HAPPENED
Operation Dream Job returned with its usual opening move: a compelling job offer aimed at engineers and defense-sector professionals. The delivery vehicle was SecurityPDF, a modified PDF viewer built to open attacker-crafted documents and execute a new backdoor named Troy.
From there the chain ran MISTPEN (in-memory downloader) Troy ForestTiger implant, then triggered the afd.sys race condition to reach SYSTEM and load the FudModule 3.1 kernel rootkit. Command and control was routed through legitimate cloud services and compromised WordPress, SharePoint and Roundcube servers, with the older CVE-2025-49113 used to plant RelayShell web shells.
WHY THE ROOTKIT IS THE REAL STORY
FudModule 3.1 does not steal data. It blinds you. It disables EDR telemetry, interferes with security products, and tampers with Windows Smart App Control by resetting its policy state.
That inverts the usual assumption. Most detection strategies assume the endpoint agent keeps reporting. Once a kernel rootkit lands, your console showing "no alerts" is not evidence of safety — it is potentially evidence of success.
WHAT TO DO NOW
PATCH CVE-2026-68820 ON EVERY WINDOWS ENDPOINT — this is a local privilege escalation, so the exposed asset is the laptop of the engineer reading LinkedIn job offers, not just your servers.
TREAT EDR SILENCE AS AN ALERT CONDITION — agents going quiet, telemetry gaps, or Smart App Control policy resets deserve investigation, not a ticket closure.
BRIEF ENGINEERING AND DEFENSE STAFF ON RECRUITMENT LURES — the initial access vector here is a social one, and it targets your most technical people specifically.
BLOCK UNSANCTIONED PDF READERS AND HUNT FOR SECURITYPDF — application allowlisting stops a modified viewer before the kernel exploit is ever reached.
The exploit was the easy part. Five weeks of undetected access came from the rootkit that turned off the lights.
Would you notice if your EDR stopped reporting on one host for a month?