CVE-2026-68820 and the AFD.sys use-after-free
Microsoft marked CVE-2026-68820 as actively exploited in the wild and addressed it in this month's Patch Tuesday security updates. The company described the flaw as a "use-after-free in Windows Ancillary Function Driver for WinSock (AFD.sys)" that can allow a locally authenticated user to increase privileges. Microsoft warned that a locally authenticated user running a specially crafted application can trigger a race condition and eventually gain SYSTEM privileges "without any user interaction." Researchers observed Lazarus leveraging the flaw since early July.
Operation Dream Job: recruitment lures and targeted sectors
Check Point researchers tracking the latest variant called the activity a wave of the long-standing Operation Dream Job campaign that targeted defense, aerospace, and aviation organizations. The campaign used fraudulent recruitment offers to employees in target organizations and, in at least one instance, a compromised organization in France was then used in spear-phishing attacks against additional targets. Check Point reported the campaign had a global reach, extending into South America including Brazil, and successful targeting in Western Europe including France and Germany, with activity also observed in India.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildFudModule kernel-mode rootkit and Smart App Control tampering
Check Point found that Lazarus incorporated an exploit for CVE-2026-68820 into a new version of the FudModule kernel-mode rootkit to elevate privileges on Windows 11 builds 26100 and 26200. This is not the first time the group exploited an AFD.sys zero-day to install FudModule. The latest rootkit retains documented capabilities such as disabling EDR telemetry and interfering with security products, and it adds tampering with Smart App Control, according to the analysis.
Troy backdoor, RelayShell, and Roundcube compromise (CVE-2025-49113)
Beyond privilege escalation, Check Point observed new tooling and web-based infrastructure abuse. The researchers reported deployment of a new backdoor called Troy that supports 17 commands; they highlighted a subset of those capabilities, including:
- System and process reconnaissance
- File upload, download, deletion, and archive-based exfiltration
- Hidden command execution
- Remote process termination
- In-memory DLL injection
- Configuration and beacon timing changes
Separately, the attackers scanned for and targeted vulnerable Roundcube installations. Check Point reported that the actor likely used leaked credentials to authenticate to Roundcube and then exploited CVE-2025-49113, an authenticated PHP object-deserialization vulnerability, to obtain remote code execution. The researchers identified at least 17 servers infected with a new PHP web shell they named RelayShell and published a YARA rule and indicators of compromise to help detection.
What this means for defense organizations, security teams, and Roundcube operators
- Defense organizations and procurement leaders: the campaign focused "heavily on the defense sector, particularly organizations involved in military technologies such as surveillance sensors, drones, and robotics," Check Point says — meaning personnel handling recruitment and third-party webmail are attractive vectors and may be used as initial footholds.
- Security teams and technologists: the combination of a kernel-mode rootkit that can disable EDR telemetry, Smart App Control tampering, and the Troy backdoor shows attackers are investing in post‑exploitation stealth and persistence; Check Point provided IOCs and a YARA rule for RelayShell to assist detection and response.
- Roundcube operators and webmail administrators: the chain observed — leaked credentials, authenticated exploitation of CVE-2025-49113, and deployment of RelayShell — underscores the risk of credential exposure and the need to identify and remediate vulnerable webmail instances.
Check Point concluded that the campaign shows Lazarus "has further evolved into stealthier operations that adapt to targeted environments," including abusing legitimate web infrastructure to hide communications. The Blue Report 2026 — cited by the researchers — notes a related operational difficulty: "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply." The report adds that its findings are drawn from large-scale simulations: "The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments."
Microsoft's patch closes the specific AFD.sys use-after-free, but the campaign documented by Check Point combines credential misuse, webshells, kernel‑level persistence, and a versatile backdoor. The facts in the report point to a mature operation that mixes social engineering with low-level exploitation and legitimate infrastructure abuse — and to a narrow window in which defenders must detect and contain activity after initial access.
