A Fake Job Offer Just Beat a Kernel-Level Security Stack. For Five Weeks.
Lazarus Group exploited CVE-2026-68820 — a use-after-free in afd.sys, the driver behind Windows Sockets — against defense, aerospace and aviation targets across Europe and India. Microsoft patched it on August 11. CISA added it to the KEV catalog the same day.
What Actually Happened
Operation Dream Job opened the way it always does: a flattering job offer aimed at engineers with clearances and specialized skills.
The delivery vehicle was SecurityPDF, a modified PDF viewer built to open attacker-crafted documents and quietly execute a backdoor researchers named Troy.
The chain ran mostly in memory — MISTPEN downloader, then Troy, then the ForestTiger implant. The afd.sys race condition fired last, handing the attacker SYSTEM privileges and loading the FudModule 3.1 kernel rootkit.
Command and control never came from suspicious infrastructure. It routed through legitimate cloud services and compromised WordPress, SharePoint and Roundcube servers.
The Rootkit Is the Real Story
FudModule 3.1 does not steal data. It blinds you.
It disables EDR telemetry, interferes with security products, and tampers with Windows Smart App Control by resetting its policy state.
That inverts the assumption almost every detection strategy rests on: that the endpoint agent keeps reporting. Once a kernel rootkit lands, a console showing no alerts is not evidence of safety. It may be evidence the intrusion worked.
Why This Lands on Laptops, Not Servers
CVE-2026-68820 is a local privilege escalation, and teams routinely deprioritize those. "Requires local access" sounds like a high bar.
It isn't. Local access is precisely what a phishing victim donates. The exposed asset here is the machine of the engineer reading recruiter messages between meetings — not the hardened box in the datacenter.
Local escalation is the hinge that turns one flattered click into kernel-level persistence.
My Take
We keep describing this as a vulnerability story. It is a targeting story.
Lazarus did not scan the internet for weak perimeters. They studied who works in aerospace, what those people want next in their careers, and which document format they open without thinking. The kernel exploit was the last step, not the first.
Every organization has a control that assumes the human will be suspicious. That control is being priced by adversaries who know exactly how a career-defining email feels at 9pm.
Patch the driver this week. But also accept that the most technical people in your building are the primary target, and that a job offer is now an attack surface.
If your EDR went silent on one laptop for a month, would anyone open a ticket?