Skip to content
OriginalSign in
Image: Check Point

Check Pointmatthewsu

Lazarus hits defence via fake job PDFs, CVE-2026-68820

Part of the CVE-2026-68820 story · since 11 Aug

Quiet for 12 weekslast report 17 Aug17 articles10 outlets
11 Aug · Check Point first28 Sep14 OctNowThis article1st of 17
  • Tue 11 Aug, 17:51 UTC. Check Point, first report. Lazarus hits defence via fake job PDFs, CVE-2026-68820. Cites a CVE in CISA KEV. This article, 1st of 17.
  • Tue 11 Aug, 18:58 UTC. SecurityWeek, its first report on the story. Microsoft Patch Tuesday Fixes Zero Day Winsock Flaw CVE-2026-68820. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 20:11 UTC. SANS ISC, its first report on the story. Microsoft Patch Tuesday August 2026, (Tue, Aug 11th). Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:01 UTC. Krebs on Security, its first report on the story. Microsoft Plugs Nearly 400 Security Holes. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:32 UTC. Dark Reading, its first report on the story. Microsoft's Patch Tuesday Deluge Continues With August Updates. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:36 UTC. CISA, its first report on the story. CISA Flags High Risk Windows WinSock Use After Free Flaw in KEV. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 00:17 UTC. CISA. CISA Flags Windows Driver Use After Free Flaw CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 00:47 UTC. Rapid7, its first report on the story. Microsoft Fixes 421 Flaws Including SharePoint Zero Day. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:40 UTC. SecurityOnline, its first report on the story. Microsoft Patch Tuesday Patches Critical WinSock Exploit. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:41 UTC. SecurityOnline. Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 07:31 UTC. Security Affairs, its first report on the story. Microsoft patches wormable DNS flaw and critical WinSock zero day. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:11 UTC. SecurityWeek. Lazarus uses fake job offers to exploit Windows CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:11 UTC. Infosecurity, its first report on the story. Microsoft Fixes 400 Flaws on August Patch Tuesday. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 13:32 UTC. SecurityOnline. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 14:11 UTC. Infosecurity. Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day. Cites a CVE in CISA KEV.
  • Thu 13 Aug, 08:52 UTC. Security Affairs. Lazarus Group exploits CVE‑2026‑68820 via fake job offers. Cites a CVE in CISA KEV.
  • Mon 17 Aug, 02:40 UTC. SecurityOnline. Critical Metabase SQLi flaw lets attackers seize full admin control. Cites a CVE in CISA KEV.

The article by Check Point Research details a significant cyber attack campaign named **Operation Dream Job**, attributed to the DPRK-linked **Lazarus group**. The campaign particularly targets organizations in the defense sector across Europe and India, utilizing a malicious PDF viewer called **SecurityPDF** to distribute a backdoor called **Troy**.

Key exploits used include **CVE-2026-68820**, a zero-day vulnerability in Microsoft's **AFD.sys** driver, and **CVE-2025-49113** affecting **Roundcube** webmail servers. The attack chain primarily involves spear-phishing, where attackers pose as recruiters offering job opportunities, convincing victims to download malicious files.

The malware employed includes the **MISTPEN** downloader and **FudModule**, a kernel-mode rootkit, escalated privileges, and deployed the **ForestTiger** backdoor with a resilient command-and-control infrastructure leveraging compromised Roundcube servers. Overall, the research emphasizes the evolving tactics of Lazarus, showcasing their ability to blend malicious activity with legitimate web operations, reflecting a trend towards stealthier cyber operations in critical sectors.

How the story developed

All 17 articles
Quiet for 12 weekslast report 17 Aug17 articles10 outlets

17 articles from 10 outlets since 11 Aug. Quiet since 17 Aug. This was the first report.

Now11 Aug12131415161718First reportCheck Point · 11 Aug, 17:51Picked up againafter 4 days quiet
  • Tue 11 Aug, 17:51 UTC. Check Point, first report. Lazarus hits defence via fake job PDFs, CVE-2026-68820. Cites a CVE in CISA KEV. This article, 1st of 17.
  • Tue 11 Aug, 18:58 UTC. SecurityWeek, its first report on the story. Microsoft Patch Tuesday Fixes Zero Day Winsock Flaw CVE-2026-68820. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 20:11 UTC. SANS ISC, its first report on the story. Microsoft Patch Tuesday August 2026, (Tue, Aug 11th). Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:01 UTC. Krebs on Security, its first report on the story. Microsoft Plugs Nearly 400 Security Holes. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:32 UTC. Dark Reading, its first report on the story. Microsoft's Patch Tuesday Deluge Continues With August Updates. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:36 UTC. CISA, its first report on the story. CISA Flags High Risk Windows WinSock Use After Free Flaw in KEV. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 00:17 UTC. CISA. CISA Flags Windows Driver Use After Free Flaw CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 00:47 UTC. Rapid7, its first report on the story. Microsoft Fixes 421 Flaws Including SharePoint Zero Day. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:40 UTC. SecurityOnline, its first report on the story. Microsoft Patch Tuesday Patches Critical WinSock Exploit. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:41 UTC. SecurityOnline. Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 07:31 UTC. Security Affairs, its first report on the story. Microsoft patches wormable DNS flaw and critical WinSock zero day. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:11 UTC. SecurityWeek. Lazarus uses fake job offers to exploit Windows CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:11 UTC. Infosecurity, its first report on the story. Microsoft Fixes 400 Flaws on August Patch Tuesday. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 13:32 UTC. SecurityOnline. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 14:11 UTC. Infosecurity. Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day. Cites a CVE in CISA KEV.
  • Thu 13 Aug, 08:52 UTC. Security Affairs. Lazarus Group exploits CVE‑2026‑68820 via fake job offers. Cites a CVE in CISA KEV.
  • Mon 17 Aug, 02:40 UTC. SecurityOnline. Critical Metabase SQLi flaw lets attackers seize full admin control. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 17 articles as a list
  1. Tue 11 AugDay 06
    1. Lazarus hits defence via fake job PDFs, CVE-2026-6882017:51 · Check Point · First report · Known exploited CVE · This article, 1st of 17
    2. Microsoft Patch Tuesday Fixes Zero Day Winsock Flaw CVE-2026-6882018:58 · SecurityWeek · Known exploited CVE
    3. CISA Flags High Risk Windows WinSock Use After Free Flaw in KEV22:36 · CISA · official · CISA alert · Known exploited CVE
    Show 3 more from 11 Aug
    1. Microsoft Patch Tuesday August 2026, (Tue, Aug 11th)20:11 · SANS ISC · Known exploited CVE
    2. Microsoft Plugs Nearly 400 Security Holes22:01 · Krebs on Security · Known exploited CVE
    3. Microsoft's Patch Tuesday Deluge Continues With August Updates22:32 · Dark Reading · Known exploited CVE
  2. Wed 12 AugDay 19
    1. CISA Flags Windows Driver Use After Free Flaw CVE-2026-6882000:17 · CISA · official · Known exploited CVE
    2. Microsoft Fixes 421 Flaws Including SharePoint Zero Day00:47 · Rapid7 · Known exploited CVE
    3. Microsoft Patch Tuesday Patches Critical WinSock Exploit03:40 · SecurityOnline · Known exploited CVE
    Show 6 more from 12 Aug
    1. Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks03:41 · SecurityOnline · Known exploited CVE
    2. Microsoft patches wormable DNS flaw and critical WinSock zero day07:31 · Security Affairs · Known exploited CVE
    3. Lazarus uses fake job offers to exploit Windows CVE-2026-6882009:11 · SecurityWeek · Known exploited CVE
    4. Microsoft Fixes 400 Flaws on August Patch Tuesday09:11 · Infosecurity · Known exploited CVE
    5. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed13:32 · SecurityOnline · Known exploited CVE
    6. Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day14:11 · Infosecurity · Known exploited CVE
  3. Thu 13 AugDay 21
    1. Lazarus Group exploits CVE‑2026‑68820 via fake job offers08:52 · Security Affairs · Known exploited CVE

  4. Quiet for 4 days

    Mon 17 AugDay 61
    1. Critical Metabase SQLi flaw lets attackers seize full admin control02:40 · SecurityOnline · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in