Back to Blog

North Korea Used a Windows Zero-Day for Five Weeks Before Microsoft Fixed It. The Lure Was a Fake Job Offer.

Picture this: one of your employees gets a message on LinkedIn from what looks like a recruiter. A defense contractor is hiring. The salary is great. There’s a PDF attached with the job details. They open it.

That PDF was North Korea.

This is the basic shape of what researchers at Check Point discovered in early August. North Korea’s Lazarus Group had been running a campaign called Operation Dream Job, using fake recruiter outreach and trojanized PDF viewers to exploit a previously unknown flaw in Windows.[1] The flaw, now tracked as CVE-2026-68820, sat in the Windows Ancillary Function Driver for WinSock, better known as AFD.sys. It’s a kernel driver. It runs at the deepest level of the operating system, underneath your applications, underneath your antivirus, underneath nearly everything else.

Check Point reported the vulnerability to Microsoft on July 28. Microsoft confirmed it three days later and released a fix on August 11 as part of the monthly Patch Tuesday update.[2] By that point, Lazarus had been quietly using it for roughly five weeks.

What the Vulnerability Does

CVE-2026-68820 is a use-after-free race condition.[3] The short version: the driver handles a block of memory and then frees it, but under certain timing conditions, the attacker can trigger the code to use that memory again after it’s been released. With the right exploit, this hands over SYSTEM-level privileges, the highest access level in Windows, to whoever triggered the race.

To be fair, this requires local access. The attacker has to already have code running on the machine, which is exactly why the fake PDF matters. You get a user to open a trojanized file, you have code running. From there, CVE-2026-68820 escalates that code to SYSTEM.

The Part That Should Worry You Even If You Have Security Software

When Lazarus exploited this flaw, they didn’t just steal data or establish a backdoor. They deployed an updated version of a kernel-mode rootkit called FudModule.[1]

Here’s why that matters. FudModule operates at the kernel level, meaning it runs with the same privileges as the operating system itself. And it has a specific capability researchers found alarming: it carries a hardcoded list of 94 endpoint detection platform identifiers and actively suppresses their telemetry.[4] Microsoft Defender, CrowdStrike, SentinelOne, and dozens of others are on that list. Once FudModule is installed, the security tools on the machine stop seeing what’s happening. They’re still running. They still show green. They just aren’t watching anymore.

This is the scenario that makes patching the only real defense. You can’t detect what you can’t see. The answer is to not let the rootkit get installed in the first place.

Operation Dream Job Has Been Running for Years

This isn’t a new campaign. Lazarus Group has been running Operation Dream Job since at least 2019. It started by targeting aerospace and defense employees, using fake offers from major contractors. Over the years, it’s expanded to include aviation, finance, cryptocurrency, and software firms.[1]

The most recent wave hit organizations across Europe, India, and Brazil.[2] The job offers look legitimate because a lot of effort goes into making them look that way. The documents are well-formatted. The recruiters have fake professional histories. The salaries are real enough to be tempting.

I’d be careful about treating this as purely a defense sector problem. The techniques don’t stay neatly inside one industry. Once a campaign this mature gets going, the tools and methods find their way into broader criminal use. The fake recruiter email is already a genre unto itself. Most small business employees haven’t been briefed on what to watch for.

There Was Also a Wormable Bug in This Month’s Update

CVE-2026-68820 wasn’t the only reason to apply August’s Patch Tuesday quickly. Microsoft also fixed CVE-2026-62878, a critical stack-based buffer overflow in Windows DNS Server.[3] No authentication required. No user interaction. An attacker on the same network, or on the internet if your DNS server is exposed, sends a single crafted packet. That’s it. Researchers flagged it as potentially wormable, meaning a working exploit could spread from one unpatched DNS server to another without any human involvement.

Three additional critical remote code execution flaws in Windows DNS Server were patched alongside it (CVE-2026-62817, CVE-2026-62820, and CVE-2026-62893).[3] If your business runs any Windows servers that handle DNS or PXE booting, those patches matter.

The CISA Deadline Has Already Passed

CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog on August 11, the same day Microsoft released the fix.[5] Federal agencies were required to remediate by August 25. That deadline has passed. If you’re running Windows endpoints or servers and haven’t applied the August Patch Tuesday updates yet, you’re three weeks behind where the federal government says you should be.

For most small businesses, Windows updates happen automatically. But automatic doesn’t mean immediate. Devices that were powered off, on vacation, or in deferred-update configurations may not have received the patch. It’s worth checking.

The question to ask your IT provider: have all Windows devices in our environment confirmed the August 2026 Patch Tuesday update? The specific fix is in KB5061768 for Windows 11 and KB5061771 for Windows Server 2022. If they can’t answer that question, that’s useful information too.