Check Point documented two separate infection chains running simultaneously within Lazarus Operation Dream Job’s latest wave. The first chain begins when a target receives a ZIP archive containing a legitimate, digitally signed PDF viewer called SmartaPDF.exe alongside a malicious DLL named libmupdf.dll and an encrypted payload file. When the victim opens SmartaPDF, it sideloads the DLL via DLL search-order hijacking. The DLL decrypts the payload using a hardcoded key, displays a convincing decoy PDF to avoid suspicion, and silently executes MISTPEN — an in-memory downloader that has appeared in previous Lazarus campaigns.

The second chain uses SecurityPDF, a modified version of the legitimate open-source MuPDF viewer. SecurityPDF looks and behaves like a normal PDF viewer for standard documents but contains a hidden check: when it opens an attacker-crafted PDF containing a specific embedded marker, it decrypts and executes an embedded payload using a single-byte XOR key, writes a loader to the user’s temporary directory, and reflectively loads Troy into memory. No suspicious installation dialogs, no UAC prompts for a viewer the user just installed voluntarily.

MISTPEN is an in-memory downloader that Check Point has observed in multiple Lazarus campaigns. Its defining characteristic is its C2 channel: it communicates exclusively through Microsoft Graph API and OneDrive, the same infrastructure that every legitimate Microsoft 365 user generates traffic through every day. From a network monitoring perspective, MISTPEN’s communications are indistinguishable from an employee syncing files to OneDrive or an application calling the Graph API for calendar or mail access. There is no suspicious domain to flag, no unusual IP to block, no self-signed certificate to catch.

After establishing communication, MISTPEN runs a reconnaissance module that profiles the compromised system — OS version, installed software, user context, network configuration — and sends the results to the operator infrastructure. Based on that profile, MISTPEN retrieves the next stage: the CVE-2026-68820 exploit module, packaged for the specific Windows 11 build running on the target machine. The exploit was built to support Windows 11 builds 26100 and 26200 specifically, which tells researchers that the Lazarus group profiled their target population carefully before selecting which Windows versions to invest exploit engineering resources in.

CVE-2026-68820 is a use-after-free vulnerability in afd.sys, the Ancillary Function Driver for WinSock. afd.sys is the kernel-mode component that manages network socket operations for virtually every Windows application — it sits at the foundation of how Windows handles TCP/IP, UDP, and all higher-level networking protocols. A use-after-free bug in afd.sys occurs when two competing threads race to access a socket state object without proper synchronization: thread A frees the object while thread B is still using it, and the attacker times the race to access the freed memory and control its contents.

In Lazarus Operation Dream Job’s implementation, successfully racing the condition yields a kernel read/write primitive — the ability to read from and write to arbitrary kernel memory addresses. From that primitive, the exploit chain elevates the attacker’s process from the user’s privilege level to SYSTEM, the highest privilege available on a Windows machine. This is the point at which the FudModule kernel-mode rootkit is installed. FudModule is a well-documented Lazarus tool that operates inside the Windows kernel to tamper with security monitoring telemetry — it was observed killing 94 security-monitoring channels in this campaign according to Techtimes coverage.

Troy is a newly documented backdoor, delivered as a 64-bit DLL and loaded entirely in memory. Check Point’s report enumerates 17 commands: drive and directory enumeration, file listing with attributes, file upload to the operator, file download to the victim, interactive command shell execution, DLL injection into a specified running process, process termination by PID, configuration retrieval and update, directory compression and exfiltration as an archive, and several additional reconnaissance and control commands. Everything an intruder needs to conduct a complete intelligence collection operation once inside a network.

Troy operates in memory without writing persistent components to disk, which limits what signature-based endpoint detection can find on a post-incident disk image. Its communications route through the same MISTPEN infrastructure — Microsoft Graph and OneDrive — meaning that Troy’s operational traffic blends with legitimate Microsoft 365 activity at the network layer. The final backdoor in the chain is ForestTiger, a well-documented malware family with long attribution history to the Lazarus threat group, which provides the persistent foothold once the in-memory stages have completed initial exploitation and data collection.

Rather than building dedicated attack infrastructure that could be traced back to North Korean IP ranges or known malicious hosting, the campaign’s latest wave uses compromised legitimate servers as relay nodes. The servers used were breached through a combination of leaked credentials and exploitation of known unpatched vulnerabilities — not custom zero-days. Compromised Roundcube mail servers and content management systems appear in Check Point’s indicator-of-compromise list as relay infrastructure.

This design means that organizations whose servers have been compromised and turned into relay nodes are themselves victims of the campaign even if they are not the intended intelligence targets. Their servers are handling Lazarus traffic, potentially generating log entries that could expose their infrastructure to law enforcement inquiries, and consuming bandwidth and processing resources for an operation they have no knowledge of. Check Point’s full indicator-of-compromise list includes these relay domains specifically so that organizations can check whether their own infrastructure has been enrolled in the campaign.

August 2026’s Patch Tuesday contained 421 CVEs. Forty-two of them were rated Critical. CVE-2026-68820 was rated Important at CVSS 7.0. In a vulnerability management program that works through Patch Tuesday releases from highest score to lowest, that means the flaw Lazarus had been actively exploiting for five weeks was queued behind 42 vulnerabilities for which there was no confirmed exploitation. Every day that queue ran, the window for Lazarus Operation Dream Job to operate on unpatched machines extended.

The EPSS model — the Exploit Prediction Scoring System — addresses this gap. EPSS scores reflect the probability that a vulnerability will be exploited in the wild within 30 days, based on technical properties and real-world exploitation signals. A vulnerability that is already being actively exploited when the patch ships should have an EPSS score approaching 1.0. CISA’s KEV listing is the bluntest version of the same signal: if a vulnerability is on the KEV list, it has been observed exploited. That fact should move it to the front of any rational patching queue regardless of its CVSS severity band.

This campaign has been running LinkedIn-based recruiting lures for years. The consistent success of the technique against defense and aerospace targets — technically sophisticated professionals who should be skeptical of unsolicited contact — reveals something important about how people process professional risk versus operational security risk. An engineer who would never open a cold email attachment from an unknown sender will open a PDF sent by a LinkedIn connection who appears to work at a company they recognize and aspire to work at.

The social engineering is doing the hardest part of the attack chain. All of the technical sophistication — the MISTPEN OneDrive C2, the CVE-2026-68820 kernel exploit, the FudModule rootkit — operates after a human being has made a voluntary decision to open a file. No vulnerability was involved in that decision. No patch can close it. The access control that failed was the employee’s judgment under conditions of motivated reasoning, and this North Korean campaign has spent six years optimizing for exactly that failure mode.

Once CVE-2026-68820 delivers SYSTEM privileges, Lazarus installs the latest version of FudModule — a kernel-mode rootkit the group has continuously updated since it was first documented by ESET in 2022. In this campaign’s version, FudModule was observed killing 94 security-monitoring channels according to Techtimes reporting. This is the same anti-forensics approach that DeadLock ransomware uses to wipe event logs, applied at the kernel level: rather than deleting log files, FudModule tampers with the kernel-mode structures that security tools use to hook into the OS monitoring layer, leaving those tools running but blind.

A SOC monitoring an environment where FudModule has been installed sees a machine that appears healthy — Defender is running, the EDR agent reports normal status, the event log is generating events — but every security-relevant event is being intercepted and discarded before it reaches any monitoring system. This is harder to detect than dead processes or missing log files because everything looks normal from the monitoring platform’s perspective. The only reliable detection requires something outside the endpoint’s own reporting chain: network flow analysis, hardware-level telemetry, or external red-team validation.