Lazarus and the kernel shortcut: CVE-2026-68820, FudModule, and Operation Dream Job
Operation Dream Job has run since at least 2020. North Korea's Lazarus Group uses it to target engineers in defense, aerospace, and cryptocurrency companies with fake job offers, then compromises their machines once contact is established. The campaign is not subtle, but it is persistent, and it works.
In the latest wave, confirmed by Check Point researchers Moshe Marelus and David Driker, Lazarus added a new weapon: CVE-2026-68820, a use-after-free vulnerability in afd.sys. That is the kernel-mode driver that backs the Windows Sockets API. It is present on every Windows system, it runs in kernel mode, and it was vulnerable.
How the vulnerability works
Afd.sys manages socket connections for applications using the Windows Sockets API. The use-after-free flaw means that under a specific race condition, memory is freed while a reference to it still exists. An attacker with a low-privileged account on the target system can trigger this race, corrupt kernel memory, and redirect execution to attacker-controlled code running at SYSTEM privilege.
The attack requires local authentication, which means an attacker needs any initial foothold on the machine first. In the context of Operation Dream Job, that foothold typically comes through spear-phishing or a trojanized document delivered as part of the fake recruitment process.
Once the race condition fires and SYSTEM is achieved, the attacker loads FudModule.
FudModule: why kernel-level matters
FudModule is Lazarus's signature kernel-mode rootkit. It first appeared around 2021 and has been linked to multiple AFD.sys bugs since, most recently CVE-2024-38193. The pattern is consistent: Lazarus identifies a Windows kernel driver bug, weaponizes it as an elevation-of-privilege step, and uses it to load FudModule, which then operates below the visibility of most security tooling.
At kernel level, FudModule can disable endpoint detection and response agents, hide processes and files, modify audit logs, and establish persistent access that survives most remediation steps that do not include a complete reimage. The practical consequence: if FudModule has run on a system, you cannot trust any security telemetry from that system without first verifying kernel integrity.
What changed with this specific exploit
Lazarus shifted from CVE-2024-38193 to CVE-2026-68820 during the first half of 2026. Check Point began tracking the new exploitation wave in early June. The campaign expanded to targets in Europe, India, and Brazil, suggesting broader geographic targeting than previous Operation Dream Job waves, which were concentrated in the United States and South Korea.
Microsoft was notified through responsible disclosure and patched CVE-2026-68820 in August 2026 Patch Tuesday, released August 11. The bug carries a CVSS score of 7.0, which reflects the local-authentication requirement. The real-world risk is higher than that number suggests: in the context of a phishing-delivered initial access, local authentication is a single step away from kernel-level rootkit deployment.
What to do
Apply the August 2026 Patch Tuesday updates. CVE-2026-68820 is now also in the CISA Known Exploited Vulnerabilities catalog with a FCEB deadline of September 1, 2026. For any system in sectors matching Operation Dream Job's known targeting, which includes defense, aerospace, aviation, and cryptocurrency, treat the patch as priority zero.
For any system that may have been exposed before patching: kernel-level compromise leaves evidence in specific places. Check Point's research includes indicators of compromise. A full forensic review is warranted for any system in the targeted sectors with unexplained kernel driver activity between June and August 2026.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are working through an incident response or threat detection challenge and need a second opinion.