CVE-2026-68820: Lazarus Used a Windows afd.sys Zero-Day for Five Weeks to Drop FudModule

Introduction

Microsoft's August 11 Patch Tuesday closed hundreds of CVEs. The one that was already on fire is CVE-2026-68820: a use-after-free race in the Windows Ancillary Function Driver for WinSock (afd.sys). A local low-privileged process can ride it to SYSTEM with no extra click. Check Point Research found Lazarus using it in Operation Dream Job against defense, aerospace, and aviation targets in Europe and India, then loading a new FudModule kernel rootkit to blind EDR. A compiled FudModule sample timestamps to July 7 — at least five weeks of silent use before the patch. CISA added the CVE to KEV on August 11 with a federal due date of August 25.

What Happened

afd.sys is the kernel piece behind WinSock. Check Point (Moshe Marelus and David Driker) reported the bug to MSRC on July 28; Microsoft confirmed July 31, assigned the CVE August 5, and shipped the fix in the August cumulatives. CVSS is 7.0. Exploitation needs code already running on the box and winning a race when several threads hit a socket at once. That is exactly the step an APT wants after a foothold: SYSTEM, then a rootkit.

This is not Lazarus's first trip through AFD. CVE-2024-38193 (August 2024) was the same driver, same FudModule family.

The rest of Dream Job this wave: fake recruiter lures (LinkedIn-class), trojanized PDF viewers (libmupdf.dll sideload, or a MuPDF-based "SecurityPDF" that executes payloads marked with a SumatraPDF-themed string), MISTPEN pulling modules via Microsoft Graph/OneDrive, then ForestTiger or the new Troy backdoor. C2 includes compromised Roundcube hosts (CVE-2025-49113) running a PHP relay webshell Check Point named RelayShell, plus impersonation sites for Enveil's PDF viewer that ranked in search.

CrowdStrike counted roughly 415–421 CVEs in the August set, 62 of them Critical, plus other disclosed zero-days. CVE-2026-68820 was the only one Microsoft marked exploited in the wild. Also in that release, and worth a separate ticket: CVE-2026-50516, a CVSS 9.4 missing-auth issue in Azure Kubernetes Service that Microsoft says it fully mitigated on the control plane with no customer patch.

Why It Matters

LPE-to-SYSTEM is how kernel rootkits get in without a second vuln. FudModule's job is to make EDR lie. Defense contractors who patched "on the next change window" handed Lazarus five extra weeks. The social-engineering half — job PDFs and SEO-poisoned viewer downloads — means the patch does not replace user-aware software allow-listing.

If you only chase internet RCEs, you will miss this. The box is already owned; this CVE is the privilege step.

Who Is Affected

  • Supported Windows 10, Windows 11, and Windows Server that missed the August 11, 2026 security updates
  • Defense / aerospace / aviation orgs in Europe and India matching Check Point's victim set — assume they were in scope
  • Roundcube webmail left on CVE-2025-49113, used as C2 relay
  • AKS customers: no node-image action for CVE-2026-50516; still review control-plane audit logs from before August 11

How to Protect Yourself

1. Install August 2026 Windows security updates (or any later cumulative) and reboot. This is a kernel driver. No reboot, no fix.

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 15
systeminfo | findstr /i "OS Name OS Version"

Confirm the build is at or above the August 11 rollup for your branch via Microsoft's CVE-2026-68820 advisory.

2. Hunt Dream Job artifacts, not just the CVE.

Get-ChildItem $env:TEMP -Filter new.exe -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\ -Recurse -Filter libmupdf.dll -ErrorAction SilentlyContinue |
  Select-Object FullName, LastWriteTime

# trojanized viewer marker is in Check Point's write-up; hunt unusual PDF readers in user Downloads
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'SecurityPDF|sumatrapdf reader' }

Look for unsigned or unexpected afd.sys companions, EDR tamper events around early July–August 11, Graph API traffic from unusual processes, and OneDrive access from non-user tools.

3. Treat recruiter PDFs as untrusted code. Block execution from Downloads. Prefer Microsoft Defender Application Control / WDAC. Warn staff that "install this PDF viewer to read the job spec" is malware.

4. Patch Roundcube independently if you still run it; RelayShell on a mail server is a C2 hop for this campaign.

5. If FudModule or SYSTEM-level tampering is credible, reimage. Kernel rootkits are not a "delete the DLL" job. Rotate credentials the host could see.

Source