The Lazarus Group’s Latest Attack Chain
North Korea’s Lazarus Group has been busy. A new campaign targeting defense and aerospace companies in Europe and India shows the hackers adopting cutting-edge cryptography — post-quantum key exchange — to protect their command-and-control traffic.
Check Point Research spotted the activity and reported the vulnerability to Microsoft on July 28. The patch shipped August 11, the same day Check Point went public with its analysis. That’s a fast turnaround for a zero-day.
The flaw, tracked as CVE-2026-68820, is a use-after-free race condition in AFD.sys — the Windows kernel driver that handles network sockets. Microsoft’s August Patch Tuesday release flagged it as the only bug under active exploitation.
This is the latest wave of Operation Dream Job, a long-running Lazarus campaign that lures employees at defense firms with fake job offers. The targets here included organizations working on surveillance sensors, drones, and robotics, with activity or targeting in France, Germany, Brazil, and India.
Post-Quantum Key Exchange in the Wild
Here’s what makes this stand out: the malware negotiated its command channel using Kyber/ML-KEM, the key encapsulation mechanism NIST standardized in 2024 to resist quantum computer attacks. That’s not something you see every day in real-world attacks.
The infection started with MISTPEN, an in-memory downloader that talks to attacker-controlled files on OneDrive via the Microsoft Graph API. After reconnaissance and persistence, it loaded a dedicated module to fetch the privilege escalation exploit.
That module fingerprinted the host, then requested four public keys from the command server. It used them to generate fresh key material with Kyber/ML-KEM, returned the encapsulated result, and only then requested the exploit — which it decrypted and ran in memory. The traffic also carried a second encryption layer using GOST-CBC, on top of MISTPEN’s own AES transport encryption.
What Arrived Through the Handshake
The payload was FudModule, Lazarus’s kernel rootkit, in a build Check Point tracks as v3.1. It disables telemetry callbacks, removes minifilters, kills the NT Kernel Logger, and blinds 94 Event Tracing for Windows (ETW) providers. Newly added is tampering with Smart App Control, resetting its policy state, and forcing a code integrity reload.
Command and Control on Borrowed Servers
Lazarus ran its infrastructure almost entirely on machines it didn’t own. The group used Roundcube webmail servers exploited through CVE-2025-49113, with credentials likely sourced from dark web leaks, plus compromised PrestaShop sites.
Each host ran RelayShell, a previously undocumented PHP webshell that acts as a message relay rather than a conventional command shell. It passes traffic between operator and victim through session files. Check Point found evidence of at least 17 compromised relay servers.
Fake Websites and a New Backdoor
Delivery has shifted too. The group built at least three websites impersonating privacy technology vendor Enveil, some ranking top in search results. Check Point stressed Enveil was neither targeted nor compromised.
Those sites distributed a trojanized PDF viewer that runs a payload hidden inside crafted documents, delivering Troy — a previously undocumented backdoor supporting 17 operator commands.
For defenders, the takeaway is clear: Lazarus keeps evolving. Post-quantum key exchange isn’t just a lab experiment anymore — it’s in the hands of nation-state hackers. If you’re in defense or aerospace, this is a good time to review your patch management and check for signs of Operation Dream Job activity.
