Not every critical attack starts with a flaw exposed to the internet. In July 2026, the North Korean group Lazarus compromised employees at defense and aerospace companies through a fake job offer on LinkedIn, then used a privilege escalation zero-day in the Windows kernel to erase its own tracks before any EDR tool noticed a thing. The flaw, only patched by Microsoft on August 11, had already been in active use for at least five weeks.
The flaw: CVE-2026-68820
The National Vulnerability Database confirms a CVSS 3.1 score of 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), classified as CWE-416, use-after-free. The vulnerability sits in the Ancillary Function Driver for WinSock (AFD.sys), the kernel driver that underpins every socket operation on Windows. A race condition in how shared state is handled across threads lets an attacker who is already locally authenticated, with low privileges and no user interaction, run a specially crafted application and gain SYSTEM privileges. It affects nearly every actively supported Windows 10 and 11 build, plus current Windows Server versions. The fix shipped on August 11, 2026, as part of Patch Tuesday, and that same day CISA added the flaw to its Known Exploited Vulnerabilities catalog, with a remediation deadline of August 25 for US federal agencies.
Operation Dream Job: the entry vector
The zero-day was never the entry point. Check Point Research, which discovered the flaw and reported it to Microsoft on July 28, traced the exploitation to a fresh wave of Operation Dream Job, the long-running North Korean espionage campaign that has used fake job offers as bait for years. Fictitious recruiters approach technical professionals on LinkedIn with an opening at a defense contractor, steer the victim to a cloned site tuned to rank well in search results, and deliver the payload through one of two paths: a trojanized PDF viewer or a DLL sideloading package, a legitimate executable bundled with a malicious DLL. From there, a downloader named MISTPEN uses the Microsoft Graph API to fetch reconnaissance modules and exfiltrate system, process, and screenshot data through OneDrive, all hidden inside traffic that looks like ordinary corporate cloud usage.
FudModule: the rootkit that erases the trail
Only after gaining SYSTEM privileges through CVE-2026-68820 does the attack reveal its real intent. The loader deploys FudModule, a kernel-mode rootkit Lazarus has been refining for years across at least three prior zero-days. Once active, it zeroes out EtwpActiveSystemLoggers inside the kernel's _ETW_SILODRIVERSTATE structure, killing the NT Kernel Logger and every CKCL session at once, which wipes out 94 ETW providers simultaneously. Add to that the selective removal of minifilters by altitude band, the disabling of Microsoft Defender's monitoring, and the blocking of memory dumps on crash. The result is a compromised system that keeps running normally while generating none of the signals EDR and SIEM tools rely on to detect post-exploitation activity.
A five-week head start
The recovered FudModule binary carries a compile timestamp of July 7, 2026, indicating Lazarus had already been exploiting the flaw for at least five weeks before Check Point reported the issue to Microsoft on July 28. Microsoft confirmed the flaw within three days, assigned the CVE on August 5, and shipped the fix on August 11. Confirmed targets include defense, aerospace, drone, and robotics companies across Western Europe, India, and South America, including Brazil.
What this changes for security testing
A kernel zero-day always makes headlines, but the attack pattern behind it is what should actually shape where security budget goes:
- Social engineering remains the cheapest entry vector, even against a high-value target with strong technical maturity
- Local privilege escalation is the link that turns 'I got a file to run' into 'I control the entire machine', and it rarely gets the same scrutiny remote RCE does
- EDR and SIEM assume the telemetry they depend on will always exist. An assumed-breach test that simulates ETW tampering or logging shutdown exposes that blind spot before a real attacker does
- Security awareness training needs to cover fake recruiting scenarios, not just generic email phishing
Testing beyond the perimeter
Most security budget still goes toward locking the front door. But the attack Lazarus ran against defense contractors shows the value of simulating what happens after someone is already inside: whether detection survives an endpoint that erases its own logs, or whether incident response only notices once it's already too late. That's exactly the kind of scenario that separates a perimeter pentest from a full red team exercise.