"It used them to generate fresh key material with Kyber/ML‑KEM, the key encapsulation scheme NIST standardized in 2024 to resist attack by quantum computers, returning the encapsulated result before requesting the exploit itself," Check Point Research writes.
A post‑quantum handshake in active operations
In a campaign against defense and aerospace companies across Europe and India, malware attributed to the Lazarus group negotiated its command channel with a post‑quantum key exchange before retrieving a Windows zero‑day, Check Point Research reported. The downloader requested four public keys from its command server and used them to produce new key material with Kyber/ML‑KEM — the NIST‑standardized key encapsulation scheme — sending back the encapsulated result and then asking for the exploit payload.
How MISTPEN and layered encryption carried the exploit
The infection chain runs through an in‑memory downloader named MISTPEN. According to Check Point, MISTPEN communicates by writing attacker‑controlled files to OneDrive via the Microsoft Graph API. That transport uses AES encryption, and the post‑quantum handshake was covered by a second layer: traffic between the operators and the victim was wrapped with GOST‑CBC on top of MISTPEN’s AES channel.
After reconnaissance and persistence stages, MISTPEN loaded a specialized module that fingerprinted the host and then executed the Kyber/ML‑KEM negotiation. What followed was the in‑memory delivery of a kernel payload: FudModule, tracked by Check Point as v3.1.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleFudModule v3.1 and CVE‑2026‑68820: a kernel rootkit and the exploited zero‑day
FudModule arrived as a kernel rootkit and carried capabilities that directly undermine Windows telemetry and logging. Check Point found that it disables telemetry callbacks, removes minifilters, terminates the NT Kernel Logger, and blinds 94 Event Tracing for Windows (ETW) providers. The newest behavior observed included tampering with Smart App Control: resetting its policy state and forcing a code integrity reload.
The exploit used to launch that rootkit targeted CVE‑2026‑68820, a use‑after‑free race condition in AFD.sys, the Windows kernel driver that handles network sockets. Microsoft identified CVE‑2026‑68820 as the sole flaw in its August Patch Tuesday set flagged as under active exploitation. Check Point Research reported the vulnerability to Microsoft on July 28 and published its analysis on August 11 — the same day Microsoft shipped the patch.
Command and control built on other people's servers: RelayShell and CVE‑2025‑49113
The operators relied almost entirely on infrastructure they did not own. Check Point found large portions of the command network hosted on compromised Roundcube webmail servers, which had been exploited through CVE‑2025‑49113, as well as on compromised PrestaShop sites. Credentials used to access the Roundcube servers were likely sourced from dark‑web leaks, the researchers said.
Each compromised host contained RelayShell, a previously undocumented PHP webshell that behaves as a message relay. Rather than presenting an interactive shell, RelayShell moves traffic between operator and victim by passing messages through session files. Check Point found evidence of at least 17 compromised relay servers used in this campaign.
Operation Dream Job: lures, trojanized viewers and the Troy backdoor
Check Point links the activity to the latest wave of Operation Dream Job, a campaign that approaches employees at defense firms with fraudulent job offers. Targets included organizations working on surveillance sensors, drones and robotics, with activity or targeting reported in France, Germany, Brazil and India.
Delivery has shifted toward impersonation of legitimate vendors. The attackers built at least three websites mimicking privacy technology vendor Enveil; Check Point stressed that Enveil was neither targeted nor compromised. Those imitation sites — some ranking high in search results — distributed a trojanized PDF viewer that executes a payload hidden inside crafted documents. That first‑stage payload can deliver Troy, a previously undocumented backdoor Check Point observed which supports 17 operator commands.
What this means for Microsoft, security teams, and defense/aerospace firms
- Microsoft: the vendor received a report on July 28 and shipped a patch on August 11 for CVE‑2026‑68820 — an exploit that carried a signed escalation into the kernel in active campaigns.
- Security teams and technologists: defenders face a blend of modern cryptographic primitives and time‑honored operational tradecraft — Kyber/ML‑KEM negotiations over cloud storage channels, GOST‑CBC layered on AES, OneDrive/Graph API abuse, and RelayShell relays on third‑party servers.
- Defense and aerospace firms: organizations working on surveillance sensors, drones and robotics in France, Germany, Brazil and India were targeted; the campaign uses fraudulent recruiting lures and trojanized applications in initial delivery.
The campaign underlines two stark facts documented by Check Point Research: adversaries are already operationalizing post‑quantum key exchange, and they continue to prefer resilient, low‑cost infrastructure — compromised webmail and e‑commerce servers, and abused cloud services — to host their relays. The combination allowed an in‑memory downloader to fetch a kernel rootkit delivered via an actively exploited Windows zero‑day (CVE‑2026‑68820) before a same‑day patch was available. Will defenders begin to parse Kyber‑based handshakes and monitor for RelayShell session relays with the same urgency they give to exotic zero‑days? Check Point’s findings frame that as the immediate operational question.
