North Korea’s Lazarus Group spent at least five weeks silently exploiting an unpatched vulnerability in Microsoft Windows to break into defense, aerospace, and aviation companies across Europe and India before a patch arrived this week. Microsoft fixed the flaw, tracked as CVE-2026-68820, on August 11 as part of its monthly Patch Tuesday release, the same day U.S. federal agencies received a remediation deadline of August 25.
What the vulnerability does
The flaw is a use-after-free race condition in afd.sys, the Ancillary Function Driver for WinSock, the kernel-mode component that manages network socket operations for virtually every Windows application.
When two competing threads race to access socket state without proper synchronization, an attacker can time the race to corrupt freed memory and obtain a kernel read/write primitive, producing full SYSTEM-level privileges.
Although exploitation requires an attacker to already have code running on the target machine, successful abuse effectively turns an existing foothold into full system-level control without requiring additional user interaction. The flaw carries a CVSS score of 7.0 and is the only vulnerability in Microsoft’s August release flagged as under active exploitation.
The August 2026 Patch Tuesday update covered 421 vulnerabilities in all, including three zero-days, of which CVE-2026-68820 is the only one confirmed as already exploited in the wild.
Operation Dream Job delivers the exploit
A recent wave of the long-standing Operation Dream Job campaign has been targeting defense, aerospace, and aviation organizations in Europe and India, using fraudulent recruitment offers to employees in target entities.
In the latest variant of the campaign, the threat actor distributed SecurityPDF, a modified PDF viewer designed to open attacker-crafted PDF documents and execute a new backdoor which Check Point named Troy. The final backdoor delivered in the chain is ForestTiger, a well-documented malware family widely attributed to the Lazarus threat group.
Check Point researchers found that Lazarus incorporated an exploit for CVE-2026-68820 that specifically supported Windows 11 builds 26100 and 26200 into a new version of the FudModule kernel-mode rootkit to elevate privileges.
Compared to the previous FudModule version, the latest variant adds new functionality to tamper with Windows Smart App Control by resetting its reputable-policy state, and drops earlier Defender- and AhnLab-specific bypasses in favor of a generic security-product suppression engine.
“What makes this campaign so dangerous is not only the zero-day vulnerability, but also how Lazarus wove legitimate, trusted infrastructure into every stage of the attack,” said Sergey Shykevich, director of threat intelligence at Check Point Software.
Five weeks of active exploitation
Check Point Research reported the vulnerability to Microsoft on July 28, 2026. Microsoft confirmed the bug on July 31, assigned it CVE-2026-68820 on August 5, and released a fix on August 11 as part of Patch Tuesday.
By the time the fix landed, Lazarus had been running the exploit for at least five weeks: a compiled FudModule rootkit artifact carries a timestamp of July 7, 2026.
Check Point observed the zero-day being exploited in Operation Dream Job since at least early July 2026 , with Microsoft crediting Check Point researchers Moshe Marelus and David Driker with the discovery.
Shykevich said Check Point was aware of one confirmed successful use of the CVE but assumed it had been used more widely across the campaign.
CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog on August 11, the same day the patch released, with a federal remediation deadline of August 25 for all U.S. civilian executive branch agencies.
Why it matters beyond the patch
This is not the first time Lazarus exploited a zero-day flaw in AFD.sys to elevate privileges and install the FudModule rootkit on targeted systems. The flaw sits in the same obscure driver that Lazarus has now exploited four separate times since 2022: the Windows Ancillary Function Driver for WinSock, or afd.sys.
The group’s ability to reuse and upgrade the same rootkit framework against a recurring Windows driver suggests persistent, well-resourced access to Windows internals research.
The bug becomes valuable after malware, stolen credentials, phishing, or another vulnerability has already provided a foothold , meaning perimeter controls and endpoint detection remain the first line of defense even after patching. For enterprise defenders, the episode underscores the risk of supply-chain social engineering as an entry vector, a concern that extends well beyond state-sponsored actors.
For organizations concerned about the broader hardware-level security guarantees being marketed alongside new devices, a recent look at quantum security chip claims in consumer products highlights how much ground the industry still has to cover.
Microsoft has not publicly attributed the exploitation in its own advisory. The August release also includes 421 vulnerabilities affecting a range of products, including 62 that Microsoft marked as “critical.” Notable critical flaws include a CVSS 9.8 stack-based buffer overflow in Windows DNS Server, characterized as wormable by the Zero Day Initiative , and a remote code execution vulnerability in Windows Deployment Services TFTP Server, neither was flagged as exploited when the updates shipped.
Security teams are advised to prioritize CVE-2026-68820 immediately and treat the remaining critical patches as urgent follow-on work, particularly in organizations with any overlap with the defense or aerospace sectors Lazarus targeted. Organizations evaluating their broader vulnerability exposure may also want to examine the open-source dependency risk that sits inside most enterprise software stacks.
