North Korea's Lazarus Group hits defense sector with zero-day hidden in fake "dream job" offers

The North Korea-affiliated Lazarus Group has unleashed a new wave of its "Operation Dream Job" campaign that uses fake job offers to infect defense sector targets with a novel Windows zero-day.

Check Point Research spent months tracking the "long-running" campaign, which has focused on defense, aerospace and aviation organizations, with activity identified in Europe, Asia and South America.

Victims are lured with phony roles at major companies they would recognize, such as Lockheed Martin, before being directed toward malicious files masquerading as genuine recruitment material.

The approach has been used by Lazarus for years. Operation Dream Job relies on attackers posing as recruiters and exploiting professional ambition to persuade carefully selected targets to open malicious files or install compromised software.

"That approach remains one of the most effective entry points used by state-sponsored threat actors today," Check Point warned.

Pyonggang's latest campaign comes after its agents used fake identities to get hired at Western companies.

Stolen legitimacy

The new campaign makes deception harder to spot by borrowing the appearance and infrastructure of legitimate organizations.

Researchers identified websites impersonating Enveil, a legitimate privacy technology company with no connection to the attack, which were used to distribute a trojanized PDF viewer called SecurityPDF. Some of the sites appeared prominently in search results.

Virtually everything the victim encountered could therefore appear trustworthy, with the attackers impersonating legitimate recruiters and companies while using real but compromised infrastructure to conceal their activities.

Once targets were reeled in, Lazarus deployed a previously undocumented backdoor alongside a Windows zero-day (CVE-2026-68820) that allowed the attackers to escalate their access to SYSTEM privileges.

Microsoft patched the vulnerability on August 11 as part of its monthly Patch Tuesday security updates.

Sergey Shykevich, director of threat intelligence at Check Point Software, said, "What makes this campaign so dangerous is not only the zero-day vulnerability - but also how Lazarus wove legitimate, trusted infrastructure into every stage of the attack.

"They hid in plain sight, behind top-ranked search results, real vendor branding, and the reputation of organisations they had already compromised. When the website, the download and the recruiter all appear authentic, the old advice to 'spot the phishing link' is no longer easily applicable.

"Staying safe now means assuming that trust itself can be counterfeited: patch the moment updates land, verify software through official channels rather than search rankings, and extend zero-trust thinking to the legitimate-looking sites and partners we interact with every day."

Dream jobs become a security nightmare

Check Point uncovered two infection chains used in the campaign.

In the first, victims are directed to download an encrypted archive containing a legitimate, digitally signed PDF viewer, a malicious DLL and an encrypted payload disguised as a PDF.

Launching the application triggers a technique known as DLL sideloading, causing the malicious code to execute while displaying a decoy job description to the victim.

The malware then runs MISTPEN, a lightweight backdoor first documented by Mandiant in 2024 during its investigation of another North Korean fake recruitment operation.

MISTPEN is capable of downloading and executing additional malware and has been observed communicating with attacker infrastructure through the Microsoft Graph API and OneDrive.

Check Point said the infection chain ultimately exploits CVE-2026-68820 before deploying ForestTiger, a Lazarus backdoor used to maintain remote access to compromised systems.

The second infection chain uses SecurityPDF, a trojanized PDF viewer distributed through websites impersonating Enveil.

Victims are persuaded to install the software and then open a specially crafted PDF. SecurityPDF checks documents for a hidden marker and, when one is detected, decrypts and launches malware embedded inside the file.

That malware loads Troy, a previously undocumented Lazarus backdoor, directly into memory.

The backdoor can enumerate files, upload and download data, execute commands, terminate processes and inject DLLs into running processes. It can also create archives for exfiltration.

Check Point linked the malware to Lazarus partly through a PDB path embedded in the binary. Similar development paths have appeared in previous Lazarus malware, including samples linked to a campaign targeting the UAV sector, as documented by ESET in 2025.

Secrets of a new zero-day

The attackers also exploited a previously unknown vulnerability in AFD.sys, a core Windows component responsible for network connections.

Check Point initially thought the flaw resembled CVE-2025-60719, an unrelated vulnerability in the same component that Microsoft patched in November 2025.

But when researchers tested the exploit against a fully updated Windows 11 system, it still worked, confirming they were dealing with a new vulnerability.

Now tracked as CVE-2026-68820, the flaw is a local privilege escalation vulnerability. That means the attackers must already have malware running on the computer to exploit it.

Once they do, however, the vulnerability allows them to escalate from limited access to SYSTEM privileges, giving their malware the kind of control normally reserved for Windows itself.

READ MORE: Criminals hack Police National Legal Database, leak UK cops' private data on the dark web

Lazarus used that access to run FudModule, a powerful kernel-mode rootkit designed to hide the attackers' presence and interfere with the security systems that would otherwise expose their activity.

The latest version builds on the FudModule malware previously analyzed by Gen Digital and adds a technique that allows it to interfere with a Windows mechanism that verifies the trustworthiness of running software.

Check Point reported the vulnerability to Microsoft on July 28. Microsoft confirmed the bug on July 31, assigned it CVE-2026-68820 on August 5 and released a fix on August 11 as part of Patch Tuesday.

Hidden in plain sight

North Korea's Lazarus Group also went to considerable lengths to disguise their command-and-control infrastructure.

Instead of relying solely on servers they controlled themselves, Lazarus compromised legitimate Roundcube webmail and content management system servers and turned them into relays between infected computers and the attackers.

Check Point named the previously undocumented PHP webshell used for this purpose RelayShell.

Some of the infrastructure was compromised using credentials already circulating in dark web leaks, while vulnerable Roundcube installations were also exposed to CVE-2025-49113.

RelayShell effectively turns someone else's legitimate server into a communications middleman.

READ MORE: Russian "Laundry Bear" threat actor rinses Western victims with zero-click exploit

Commands from attackers and responses from infected machines are exchanged via files stored on the compromised server, making malicious communications harder to distinguish from traffic involving ordinary web infrastructure.

The operators were also observed connecting through commercial VPN services, adding another layer between themselves and the infrastructure used in the attacks.

In at least one case, a legitimate organization that had already been compromised was subsequently used to send phishing messages to further targets.

That allowed Lazarus to exploit not just someone else's infrastructure but also their reputation.

The attack demonstrates how far targeted phishing has moved beyond the traditional suspicious email containing an obviously dubious link.

Checking whether a recruiter, website, or server appears legitimate is no longer necessarily enough when sophisticated attackers can counterfeit - or simply borrow - the trustworthiness of the real thing.

Read the full Check Point Research investigation.