What Check Point says happened
Per Check Point Research and reporting by The Hacker News, the activity is part of Operation Dream Job, a long-running social-engineering and cyber-espionage campaign run by Pyongyang-backed hackers who have posed as recruiters on platforms such as LinkedIn. Targets included professionals at defense and aerospace companies in France, Germany, Brazil, and India. Victims were lured with convincing fake job offers referencing firms such as Lockheed Martin and Enveil, then tricked into opening a malicious PDF or installing a trojanized PDF viewer that ultimately delivered malware.
Two parallel infection chains: DLL side-loading and SecurityPDF
Check Point identified two distinct but concurrent delivery methods. In the DLL side-loading chain, victims were instructed to download an encrypted archive that triggered a DLL side-loading sequence. A malicious DLL named libmupdf.dll presented a bogus job description while quietly loading a lightweight downloader called MISTPEN into memory. MISTPEN used Microsoft Graph API and OneDrive to retrieve reconnaissance and persistence modules, invoked the AFD.sys exploit, and then deployed a remote-access tool known as ForestTiger (aka ScoringMathTea).
The second sequence used a trojanized PDF viewer dubbed SecurityPDF. Victims were directed to download SecurityPDF from websites impersonating Enveil. The application monitored opened PDFs for a marker string — "This document is encrypted with sumatrapdf reader!!!!!!!!!!!!" — and, if present, decrypted and launched an embedded payload that loaded the Troy backdoor directly into memory. The Troy implant supports 17 operator commands including file enumeration, upload/download, archive and exfiltration, interactive shell access, process termination, in-memory DLL injection, and configuration updates.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageMISTPEN, FudModule 3.1 and the SYSTEM pivot
MISTPEN is modular. Check Point says it loads at least four named modules: GetInfoPlugin (Release_GetInfoPlugin_x64.dll) that profiles the host and exfiltrates a wide-character string; PvPlugin (Release_PvPlugin_x64.dll) for host and process reconnaissance; OneScreenCapture (OneScreenCapture64.dll) to capture desktop screenshots and transmit them as JPEGs; and an LPE loader that gathers host information, generates new key material using an ML-KEM post-quantum key encapsulation algorithm, and uses that negotiated key to decrypt and run FudModule.
The attackers leveraged a kernel-mode rootkit lineage the group has used since at least 2022 and an updated component, FudModule 3.1, to conceal tools and tamper with Windows protections. Check Point described how the code, running in a SYSTEM-level msiexec.exe child process, "sets VerifiedAndReputablePolicyState to zero and invokes NtSetSystemInformation class 0xA4 with option 0x10000000, triggering an in-place reload of the code integrity policy." The exploit of AFD.sys allowed the adversary to obtain SYSTEM privileges and inject another instance of MISTPEN into a SYSTEM process so it runs with elevated privileges outside the notice of many security tools.
Hijacked infrastructure, fake vendor sites, and RelayShell
Rather than rely solely on bespoke infrastructure, the campaign abused legitimate but compromised WordPress and SharePoint sites and vulnerable Roundcube webmail servers to run ForestTiger command-and-control. Many Roundcube servers were vulnerable to CVE-2025-49113, and attackers used that weakness to deploy a previously undocumented PHP web shell Check Point named RelayShell. RelayShell exchanged commands and responses in the form of text files. In one instance, an already breached France-based organization was used to send phishing messages to new victims, helping the attackers evade reputation-based filters.
Check Point also found at least three domains impersonating Enveil to distribute SecurityPDF: envell[.]xyz, enveil[.]online, and uxtramine[.]org. It remains unclear how those fake portals were integrated into specific social-engineering messages, though Check Point suspects victims received a malicious PDF and were then urged to download the viewer from a site appearing to be the vendor's.
What this means for defense and aerospace firms, security teams, and the public
- Defense and aerospace firms: organizations operating in the targeted sectors should assume social-engineering channels can be weaponized with convincing recruiter lures and vendor impersonation, and that attackers may already be using legitimate-looking sites and compromised third-party infrastructure to host C2.
- Security teams and technologists: the campaign demonstrates a layered approach — in-memory loaders, a modular reconnaissance toolset (MISTPEN), a kernel exploit (CVE-2026-68820) and a rootkit-based persistence and evasion component (FudModule 3.1) — meaning detection and response must cover in-memory activity, code-integrity policy changes, and abuse of trusted cloud APIs such as Microsoft Graph and OneDrive.
- End users and procurement leads: Check Point's director of threat intelligence, Sergey Shykevich, warned that "when the website, the download and the recruiter all appear authentic, the old advice to 'spot the phishing link' is no longer easily applicable." He urged immediate patching, verifying software through official channels rather than search rankings, and applying zero-trust principles to legitimate-looking partners and sites.
Conclusion
Check Point's findings show Operation Dream Job remains operational and technically adaptive: social engineering remains the vector, but the payloads and infrastructure are sophisticated and resilient. The combination of a newly patched Windows kernel flaw (CVE-2026-68820), modular in-memory loaders, a SYSTEM-level pivot, and the use of hijacked legitimate infrastructure complicates detection and containment. As Sergey Shykevich put it, the campaign "hid in plain sight" behind trusted branding and compromised sites — a reminder that authenticity can be counterfeited as effectively as credentials.
Original reporting: https://thehackernews.com/2026/08/lazarus-exploits-windows-zero-day-to.html
