Cybersecurity

Lazarus Ran a Windows Zero-Day for Ten Weeks

Check Point traced North Korea's Lazarus Group exploiting a Windows kernel flaw against European defense firms since June, patched only on August 11.

CybersecurityBy Servola Tech Desk2026-08-125 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Lazarus Ran a Windows Zero-Day for Ten Weeks

Key takeaways

Check Point traced Lazarus Group's exploitation of the Windows AFD.sys kernel flaw, CVE-2026-68820, to the beginning of June 2026, roughly ten weeks before Microsoft's fix shipped on August 11, so a defense or aerospace firm that treats Patch Tuesday as its detection mechanism has been checking for smoke long after the wiring was already live.
The bug carries a CVSS score of only 7.0, a mid-range figure, because it is a local privilege escalation and not a remote way in on its own - the number describes one link in a chain that started with a forged job offer and ended at SYSTEM.
Check Point Research says the operators paired the flaw with a new kernel-mode variant of the FudModule rootkit and a previously undocumented backdoor it named Troy, giving Lazarus a persistence and full-control combination on compromised machines, not just a one-time privilege bump.
CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog on August 11 with a remediation due date of August 25, a deadline that governs the response to a flaw that had already been live against real targets for about ten weeks.

A Use-After-Free in the Driver Every Windows Socket Touches

CVE-2026-68820 sits in AFD.sys, the Ancillary Function Driver for WinSock, the kernel-mode component that every Windows application touches the moment it opens a network socket. Microsoft's advisory describes it as a use-after-free triggered by a race condition: a locally authenticated attacker can run a specially crafted application that hits the driver from several threads at once, catches it in an inconsistent state, and rides that inconsistency to code execution inside the kernel. The advisory sets the CVSS base score at 7.0 and the outcome plainly as privilege escalation to SYSTEM, the highest level of control a Windows machine grants.

The word 'locally authenticated' matters as much as the word 'kernel.' This flaw does not let an outsider into a machine by itself; it lets someone who is already running code on that machine become the machine's owner. That distinction is not a technicality. It is the exact shape of the second stage in an intrusion, and it is the stage this particular actor built its entire campaign around.

Operation Dream Job: A Fake Recruiter Was the Way In

Check Point researchers Moshe Marelus and David Driker attributed active exploitation of CVE-2026-68820 to North Korea's Lazarus Group, operating under the long-running lure campaign the firm tracks as Operation Dream Job. The approach is social, not technical: forged recruitment outreach impersonating Lockheed Martin and the privacy-technology firm Enveil, sent to employees at defense, aerospace and aviation organizations across multiple countries, with concentrated activity against targets in Europe and India. The pitch is an attractive job offer; the attachment is the first-stage payload.

Once a target opened the lure and ran the attached file, the operators had local code execution, which is the precondition CVE-2026-68820 needs. From there Check Point observed a new kernel-mode variant of the FudModule rootkit deployed alongside a previously undocumented backdoor the firm named Troy, then the AFD.sys race condition used to climb from a regular process to SYSTEM. A convincing email, one click, and a state-linked operator owns the endpoint outright.

Ten Weeks Between First Exploitation and the Fix

Check Point says it first observed attackers battering this specific flaw at the beginning of June 2026. Microsoft did not ship a fix until the August 11 Patch Tuesday cycle, which puts roughly ten weeks between confirmed in-the-wild exploitation and a patch existing at all. CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog the same day the patch shipped, with a remediation due date of August 25 under Binding Operational Directive 26-04.

The patch itself arrived inside a large monthly release: Microsoft's own count for the cycle was 421 CVEs, while the independent Zero Day Initiative tracker counted 398 new CVEs with 62 rated Critical. Whichever count is used, CVE-2026-68820 was the single item Microsoft flagged as under active exploitation that month, one confirmed real-world attack sitting inside a bundle of several hundred theoretical ones.

Why Patch Tuesday Cannot Be the Defense Sector's Early-Warning System

Patch Tuesday runs on a fixed monthly clock. A targeted state-actor campaign runs on its own schedule, and in this case that schedule gave Lazarus roughly ten weeks of working SYSTEM-level access against exactly the sector with the least tolerance for it. For most industries, a ten-week exposure window on a mid-severity local flaw is an acceptable cost of a monthly patch cycle. For a defense contractor already hand-picked by a state intelligence service through a forged job offer, that same window is the entire campaign, start to finish, run to completion before a fix existed to interrupt it.

The failure here was never the patch cadence; Microsoft moved once it confirmed exploitation, and the fix arrived inside a normal release cycle. The gap was detection during the ten weeks when no patch existed to close it. That reframes the actual problem for defense and aerospace security teams: the exposure they need to manage is not primarily a patching-speed problem, it is a behavioral-detection and social-engineering problem, and treating monthly patch compliance as the answer to a targeted campaign misreads what the campaign actually was.

What Defense and Aerospace Security Teams Should Do This Week

Apply the August patch now; that step is not optional. But the patch alone does not address the ten-week window this incident just demonstrated, so pair it with detection tuned to the technique rather than the CVE number: unexpected privilege escalation originating from socket-handling or driver-level activity, unsigned or unfamiliar kernel-mode driver loads outside a scheduled change window, and rootkit-style persistence behavior rather than a signature match against a specific file hash that will be different next time.

Second, treat recruitment outreach as an attack surface for anyone whose role makes them a plausible target: engineers and program staff with public profiles referencing defense or aerospace programs, HR and recruiting contacts who receive unsolicited approaches by design. A short, mandatory verification step before opening an attachment from an unknown recruiter, no matter how credible the branding, closes the exact entry point this campaign used every time.

Frequently asked questions

What is CVE-2026-68820 and what does it actually let an attacker do?

CVE-2026-68820 is a use-after-free vulnerability in AFD.sys, the Windows Ancillary Function Driver for WinSock, carrying a CVSS score of 7.0. Microsoft's advisory describes it as a race condition that a locally authenticated attacker can trigger to escalate privileges to SYSTEM, the highest privilege level on a Windows machine. It affects the WinSock driver present across Microsoft's currently supported Windows client and server releases; check Microsoft's own advisory for the exact build list before patching.

Does this flaw give an attacker remote access to a machine by itself?

No. It is a local privilege escalation, which requires the attacker to already have code execution on the target system. In the campaign Check Point documented, that initial access came from a target opening a malicious attachment sent through a forged job-recruitment approach. CVE-2026-68820 was the second stage, used to turn that initial foothold into full SYSTEM-level control, not the way in on its own.

Does the CISA remediation deadline of August 25 apply to a European defense contractor?

No. Binding Operational Directive 26-04 binds United States federal civilian agencies, not private companies in Europe. What does travel across the Atlantic is the underlying finding: a dated, publicly documented confirmation from Check Point Research and CISA that a state-linked actor exploited this flaw against defense and aerospace targets, including in Europe, before a patch existed. That evidence is useful on its own terms regardless of which government's deadline attaches to it.

A patch cycle measures how fast a vendor can ship a fix once it knows about a problem; it was never built to measure how long a state actor can operate quietly before that knowledge exists. Lazarus had roughly ten weeks of working SYSTEM access inside defense and aerospace organizations through a technique that began with a fake job offer and ended with a kernel exploit, and none of that window shows up in a compliance report that only tracks patch application dates. The firms that come out of this correctly will be the ones that stopped waiting for Patch Tuesday to tell them a targeted campaign was underway.

CVE-2026-68820Lazarus GroupAFD.sysCheck Point ResearchCISA KEVPatch Tuesday

The Cisco Bug Under Attack Scored Just 5.3

Cisco scored its Firewall Management Center credential flaw 5.3 and rated it High on the same page. CISA gave it three days. What that gap does to patch triage.

5 min read

Cybersecurity

45,601 Flaws This Year. 171 Are Being Used.

We counted both feeds on 28 July: 45,601 vulnerabilities published this year, 171 added to CISA's exploited list. The two curves have separated, and your patching policy is indexed to the wrong one.

5 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.

4 min read

← All articles