Lazarus Group Exploits Windows Kernel Zero-Day CVE-2026-68820 to Deploy FudModule Rootkit
The North Korean Lazarus APT group has been actively exploiting a zero-day vulnerability in the Windows kernel to escalate privileges to SYSTEM level and install the FudModule rootkit. The flaw, tracked as CVE-2026-68820, resides in the afd.sys driver responsible for network functions and socket management. Microsoft released a patch for the issue on August 11. The attacks form part of the ongoing Operation Dream Job campaign, which uses fake job offers to target professionals in defense, aerospace, and aviation sectors. Victims in Brazil, Europe, and India are tricked into opening malicious PDF viewers or prepared files that deliver the MISTPEN downloader. Once initial access is obtained, the zero-day exploit elevates privileges, allowing FudModule to tamper with Windows telemetry and weaken EDR solutions as well as Smart App Control.
BoletimSecAug 13, 2026Translated from Portuguese