For several weeks, the supposed recruiter maintained the rhythm and detail of a genuine hiring process. The targets were engineers working for European defence and aerospace companies. The final package contained a job description and an application for opening it; running that software launched a memory-resident downloader, a backdoor and a rootkit designed to conceal itself and other malicious components. An unpatched zero-day then allowed the attackers to reach the Windows kernel.
Check Point Research named the campaign Shattering the Dream and describes it as the newest stage of Operation Dream Job, the long-running fake-employment operation associated with the North Korean Lazarus group. The activity began in early 2026 and produced confirmed compromises in France and Germany. Microsoft addressed CVE-2026-68820 in the Patch Tuesday update released on 11 August 2026.
From a fake recruitment process to the Windows kernel
The bait: a carefully rehearsed hiring process
The opening approach copies the features of a legitimate recruitment conversation. According to Check Point Research, the operators posed as Enveil, a US privacy-technology business that had no role in the attack beyond having its identity misused. Other approaches recycled a Lockheed Martin job description. This was targeted spear phishing aimed at named professionals with access to designs, military programmes or industrial systems.
The selected industries reveal a deliberate strategy. Defence, aerospace, aviation, drones, robotics and military technology contain the intellectual property commonly sought in state espionage. Engineers in these fields also receive real job enquiries often enough for a polished approach to feel routine.
A hiring conversation gives attackers an advantage that most social engineering stories cannot provide: a credible reason to exchange documents and software over several days while a responsive correspondent keeps the fiction alive.
The most straightforward defence is to verify the approach through a separate route. When an offer claims to represent a particular company, contact that organisation through its official channels rather than the details supplied by the recruiter. In the documented incidents, that single check would probably have exposed the deception.
Two infection paths hidden behind one story
Researchers identified two chains operating in parallel. The route carrying the zero-day started with an encrypted archive containing a legitimate signed PDF viewer, a malicious DLL called libmupdf.dll and an encrypted payload disguised with a .pdf extension. Launching the viewer caused Windows to load the adjacent DLL through an attacker-controlled search order, a method known as DLL side-loading. A decoy document appeared while the DLL unpacked the implant and executed it directly in memory.
The design frustrates investigation by scattering the evidence. The signed viewer passes reputation checks, the harmful logic sits in the DLL beside it and the final payload remains encrypted. Examined separately, each item reveals only part of the operation.
The alternative path did not use the zero-day. It relied on SecurityPDF, a trojanised viewer promoted through websites impersonating Enveil and positioned prominently in search results. That application installed a new backdoor named Troy. The stolen brand and recruitment narrative stayed the same, but the final payload differed.
MISTPEN hides control traffic inside Microsoft Graph
In the primary chain, the DLL runs MISTPEN entirely in memory. The downloader surveys the host, establishes persistence and retrieves additional modules. Its command-and-control channel is particularly difficult to stop because it uses Microsoft Graph and attacker-controlled files stored in OneDrive.
To a corporate firewall, those connections lead to genuine Microsoft services used every day by millions of organisations. There is no obviously malicious domain to block or poor reputation score to flag: the operator blends into the same Microsoft 365 cloud on which the victim depends.
MISTPEN ultimately installs ForestTiger, a backdoor family that had already been widely linked to Lazarus. Check Point Research treats the presence of this known malware as further support for its attribution of the campaign.
The defensive consequence is unambiguous: an organisation cannot investigate this activity without visibility into outbound cloud traffic. At a minimum, every Graph request must be tied to the originating process, device and identity.
Using a zero-day to move from user space to the kernel
What separates this operation from an ordinary email-espionage case is its climb into the kernel. CVE-2026-68820 is a use-after-free vulnerability in afd.sys, the Windows driver supporting Winsock networking operations. An attacker who already has code running on the device can use it to escalate privileges to SYSTEM. Its CVSS score is 7.0.
The vulnerability cannot be exploited remotely on its own. Local code execution has to come first. In this campaign, the victim satisfied that requirement by opening the supposed job description with the viewer supplied by the attacker.
After reaching SYSTEM, the operators installed FudModule 3.1, a new version of a kernel-mode rootkit tracked since 2022. At a conceptual level, it alters internal Windows structures to reduce the visibility of security products: the machine appears to operate normally while its protection tools stop recording the most important activity.
The remediation moved unusually fast. Check Point disclosed the issue to Microsoft in late July 2026, and the fix arrived on 11 August as part of Patch Tuesday. That is a short interval for a kernel vulnerability already being used by a state-linked actor.
This was not the first Lazarus operation to focus on the same driver. The Hacker News and BleepingComputer note that the group used CVE-2024-38193, another afd.sys zero-day, to deploy FudModule in 2024. Repeated attention to one component suggests a vulnerability-research programme sustained over time.
How the operation slips past familiar controls
Every stage is shaped to defeat a different safeguard. Encryption and fragmentation hinder static inspection, memory-only execution deprives file-based tools of evidence, and Graph traffic disappears into normal Microsoft 365 activity. Automated sandboxes face the same problem: they would need both files, the archive password and the bundled viewer, then reproduce the complete opening sequence. Few analysis systems do all of that reliably.
At the final stage, the malware targets the observer itself. Once FudModule reaches the kernel, an EDR product may continue to report apparently normal data while missing the events that matter. This resembles the problem explored in EDR blind spots on network edge devices: the sensor is either absent from the point of attack or present but unable to see it.
Serious privilege-escalation flaws are not exclusive to state operations. Cases such as RoguePlanet in the Microsoft Defender engine show that very different adversaries can travel from a user session into the kernel through multiple routes.
Detect behaviour first, signatures second
Early in the intrusion, the strongest clue is behaviour that makes no sense in context. A document viewer that starts child processes, writes into profile directories or opens outbound connections deserves immediate scrutiny; one contacting graph.microsoft.com is an even clearer warning.
Linking process identity to network destination is a practical investigative method. In a well-managed estate, Graph requests from binaries not signed by Microsoft, or from applications running in user-writable locations, should be uncommon. A retrospective threat hunting exercise using Check Point Research's indicators can answer the question leadership will eventually ask: would the organisation know if this campaign had reached it?
Later, the evidence becomes quieter but more serious as telemetry itself deteriorates. Sensors that stop reporting, gaps in one host's event sequence or responsive agents that cease sending particular event types may indicate kernel tampering. Those symptoms should be handled as a suspected compromise, not an ordinary support fault.
Check Point Research's technical report provides the indicators of compromise. Threat intelligence teams, including Hard2bit, can feed them into continuous monitoring to look for both known campaign infrastructure and the associated patterns of behaviour.
A coordinated defence: patching, people and response
The immediate priority is to deploy the August 2026 security update throughout the Windows estate. Systems used by engineering, R&D and technical leadership in the affected industries should come first. Once a fix exists and active exploitation is confirmed, delaying installation leaves an exposure that is difficult to defend.
The initial-access problem requires a people-focused measure. One simple rule breaks the entire chain: a legitimate job offer will not require a candidate to install a special viewer merely to read the role description. Reinforcing that message with senior technical staff, who may not see themselves as phishing targets, is more valuable than a generic list of cautions.
Application control creates another barrier even when the deception succeeds. A PDF viewer delivered by email should not be allowed to run on the workstation of an engineer with access to sensitive programmes. Policies that restrict approved software turn that expectation into an enforceable control.
If FudModule might have executed, the host must be treated as compromised at kernel level. It should be isolated, rebuilt from a trusted source, and every credential and session that passed through it should be rotated, including cloud sessions. Incident response must assume that local telemetry may have been manipulated and rely instead on external evidence from network, identity and cloud logs.
Industrial and defence organisations seeking to measure their exposure can work with a cybersecurity company that combines threat intelligence with proactive hunting. That capability turns the findings of a public report into specific checks across the organisation's own estate.
What this operation tells defenders
Lazarus did not use the zero-day to cross a firewall. It kept the exploit for the stage after initial access and relied on the cheapest component for entry: the professional trust of an engineer receiving a document from a would-be employer. Finding and weaponising the kernel flaw may have taken months; building the lure required only a convincing identity and a sustained conversation.
The conclusion for Europe is direct. As long as fraudulent recruitment approaches continue to work, zero-day exploits will have a route into target networks. Confirmed cases in France and Germany show that the continent's defence and aerospace industries are among the operation's intended victims.
This article is intended for defensive and educational use. Detection and hardening measures should be adapted to each organisation and tested before production deployment. The campaign description relies on public information available in August 2026, and threat-group attribution may change as new evidence emerges. In this post, when we talk about Lazarus we mean the advanced persistent threat (APT) group. It has been tracked since at least 2009 and operates under several names depending on the vendor: Hidden Cobra (the US government's designation), APT38 for its financial arm, and other aliases such as ZINC or Diamond Sleet in Microsoft's taxonomy.
