Inside the Lazarus Attack: Windows Zero-Day, Kyber Encryption, and the Breach of Global Defense Firms

What Made This Attack Different

Lazarus has run Operation Dream Job since 2020, but this wave introduced three significant technical upgrades :

1. A previously unknown Windows zero-day (CVE-2026-68820) in the AFD.sys driver
2. Post-quantum key exchange using Kyber/ML-KEM to encrypt command-and-control traffic
3. A new modular backdoor called Troy, communicating over hijacked legitimate servers

The Attack Chain, Step by Step

1. Social Engineering via Fake Job Offers

Victims were approached on LinkedIn and other professional platforms by operators impersonating recruiters from Lockheed Martin and the privacy-tech firm Enveil . Targets received a job description and a link to downloadable "interview materials." Two parallel infection chains were used :

• Chain A (DLL sideloading): The victim downloaded a ZIP archive containing a legitimate, digitally signed PDF viewer executable, a malicious DLL (libmupdf.dll), and an encrypted payload with a .pdf.enc extension. When launched, the PDF viewer sideloaded the malicious DLL, which displayed a decoy PDF while silently decrypting and executing the payload .
• Chain B (Trojanized PDF viewer): The victim downloaded a fake application called SecurityPDF, which impersonated a legitimate PDF viewer based on MuPDF. This trojanized viewer appeared legitimate but loaded malicious code when opening a specially crafted PDF .

2. Post-Quantum Encryption Protects the C2 Channel

Once the initial loader executed, it deployed a fingerprinting module that contacted the command server and requested four public keys. The module used Kyber / ML-KEM—the NIST-standardized post-quantum key encapsulation mechanism—to generate fresh key material, encapsulate a shared secret, and send the result back to the server before requesting the actual exploit payload .

This was the first documented use of post-quantum encryption by Lazarus to protect exploit delivery. The technique ensured that even if network traffic was intercepted, the C2 channel could not be decrypted by classical or quantum-capable adversaries .

3. The Zero-Day: CVE-2026-68820 in AFD.sys

The delivered payload exploited CVE-2026-68820, a use-after-free race condition in afd.sys, the Windows Ancillary Function Driver that handles kernel-mode Winsock operations . Key technical details include:

• CVSS score: 7.0 (high)
• Precondition: The attacker already needed local code execution from the initial loader
• Exploitation mechanism: The race condition had to be won to successfully free and reallocate kernel memory, allowing the attacker to corrupt kernel objects and achieve local privilege escalation to SYSTEM
• Recurring vector: This was the same driver (AFD.sys) Lazarus abused in at least four prior campaigns since 2022, making it a recurring attack surface .

4. FudModule Kernel Rootkit Deployment

After gaining SYSTEM privileges, the exploit deployed an upgraded version of FudModule, Lazarus's signature kernel-mode rootkit . This version—sometimes labeled FudModule v3.1—supported Windows 11 builds 26100 and 26200 . FudModule operated with full kernel access to:

• Disable endpoint detection and response (EDR) tools at the kernel level
• Blind security products by tampering with kernel callbacks and process monitoring
• Establish persistence and load additional modular backdoors, including MISTPEN and the new Troy backdoor

5. Troy Backdoor and Hijacked Infrastructure

The final stage used the Troy backdoor, a newly documented modular remote access tool. Its command infrastructure was built almost entirely from hijacked legitimate servers—the attackers did not build their own infrastructure but rather compromised other organizations' servers .

Countries and Sectors Targeted

Mitigation and Response

Microsoft's Patch

• Microsoft released a fix on August 11, 2026 (Patch Tuesday), patching 398 CVEs including CVE-2026-68820
• The fix followed responsible disclosure by Check Point Research, which identified the zero-day exploitation and reported it to Microsoft
• Microsoft flagged CVE-2026-68820 as the only actively exploited vulnerability in that month's release

CISA Emergency Directive

• The Cybersecurity and Infrastructure Security Agency (CISA) issued a mandatory Emergency Directive ordering all U.S. Federal Civilian Executive Branch (FCEB) agencies to remediate CVE-2026-68820
• Agencies were given a deadline of August 25, 2026 to apply the patch
• CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, requiring action by all federal organizations and recommending action by all private-sector organizations

Recommended Actions for Organizations

• Apply Microsoft's August 2026 Patch Tuesday updates immediately, prioritizing CVE-2026-68820
• Monitor for anomalous AFD.sys activity, unexpected kernel driver loads, and EDR tampering
• Educate employees about fake recruiter lures and trojanized document viewers
• Implement network-level detection for Kyber/ML-KEM key exchange traffic on unexpected channels

Why This Matters

This campaign represents an escalation in sophistication from a state-sponsored threat actor that is already one of the most prolific. The use of post-quantum encryption to protect exploit delivery suggests that Lazarus is both monitoring defensive capabilities and investing in future-proofing its operations. The repeated targeting of the same AFD.sys driver—now exploited at least four times since 2022—highlights a persistent vulnerability surface in the Windows kernel that Microsoft continues to patch reactively .