CISA Orders Patching of Windows Zero-Day Exploited by North Korean Hackers

CISA has ordered federal agencies to patch a Windows kernel vulnerability that North Korean hackers are actively exploiting in a campaign against defense and aerospace job seekers. The bug, tracked as CVE-2026-68820, lives in AFD.sys, the Ancillary Function Driver that manages network sockets inside the Windows kernel, and was the only vulnerability in Microsoft's August Patch Tuesday release confirmed to be under real-world attack, CISA and Microsoft said Tuesday.

Operation Dream Job

Check Point Research said it disclosed the bug to Microsoft after discovering it during an investigation of a fresh wave of Operation Dream Job — a long-running Lazarus Group campaign that weaponizes the job application process. The hackers impersonated recruiters for Lockheed Martin and privacy-tech firm Enveil, contacting targets on LinkedIn before sending malicious PDF files that installed a backdoor. The flaw allows an attacker who already has malware on a machine to escalate from limited access to complete control of it — the kind of control normally reserved for the operating system itself.

FudModule v3.1

Successful exploitation grants SYSTEM-level privileges and launches FudModule, Lazarus's signature kernel-mode rootkit, in a new v3.1 variant that strips telemetry callbacks, disables minifilters and blinds more than 90 Event Tracing for Windows providers. The attack chain runs through MISTPEN, an in-memory downloader that abuses the Microsoft Graph API, and can deploy the ForestTiger backdoor or Troy, a newly identified 17-command implant. Check Point counted at least 17 compromised relay nodes built on Roundcube webmail and WordPress or PrestaShop sites, with victims confirmed across Europe, India and Brazil.

CISA gave agencies until August 25 to apply the fix, which requires a device restart and has no workaround. The same driver component was exploited by Lazarus in 2024 via a separate use-after-free bug, CVE-2024-38193, a pattern Automox CTO Jason Kikta said makes patching this release urgent, not optional.