# Lazarus Group Exploits Windows Zero-Day for Advanced Rootkit Deployment

*Published August 14, 2026*
*Source: [https://cybersecuritynews.com/windows-afd-sys-zero-day-exploited/](https://cybersecuritynews.com/windows-afd-sys-zero-day-exploited/)*

## Executive Summary

Lazarus Group is exploiting a Windows zero-day vulnerability to deploy an upgraded rootkit as part of their espionage campaign targeting high-value sectors. The flaw, patched by Microsoft in August, allows Lazarus to gain SYSTEM-level privileges and operate stealthily within compromised networks.

## Article

The North Korean hacking group Lazarus has been found exploiting a zero-day vulnerability in the Windows kernel to deploy an upgraded version of its FudModule rootkit. According to Check Point Research, the vulnerability, identified as CVE-2026-68820, was discovered in the AFD.sys driver, which manages network sockets within the Windows kernel. Microsoft addressed this flaw in its August Patch Tuesday update, shortly after Check Point disclosed it.

This exploitation is part of Operation Dream Job, an espionage campaign targeting the defense, aerospace, and aviation sectors across Europe, India, Brazil, and other regions. Lazarus employs social engineering tactics by posing as recruiters to lure employees of high-value targets into opening malicious files. Check Point has identified two infection chains used by Lazarus. The first involves DLL sideloading, where victims download an encrypted ZIP file containing a legitimate PDF viewer, a malicious DLL, and an encrypted payload. The second chain uses a trojanized PDF viewer based on the MuPDF framework, impersonating Enveil, a privacy technology firm.

Both methods execute MISTPEN, an in-memory downloader that abuses the Microsoft Graph API to retrieve additional modules from OneDrive, encrypting traffic with AES. Once the target is validated, a privilege-escalation module triggers the AFD.sys exploit, granting SYSTEM-level privileges and launching the FudModule rootkit. This new variant, FudModule v3.1, includes enhancements such as a generic suppression engine for security products and the ability to tamper with Smart App Control.

Lazarus further obfuscates its activities by routing command-and-control traffic through compromised webmail and CMS sites using RelayShell, a PHP web shell that blends malicious traffic with normal web activity. Organizations using Windows 11 builds 26100 or 26200 should prioritize the August update to patch CVE-2026-68820. Security teams in the defense sector should closely monitor outbound traffic to detect potential covert relay points.