Malware used by North Korea’s Lazarus group negotiated its command channel using a post-quantum key exchange before pulling down a Windows zero-day exploit, in a campaign against defense and aerospace companies across Europe and India.
Check Point Research reported the vulnerability to Microsoft on July 28 and published its analysis on August 11, the day a patch shipped.
CVE-2026-68820 is a use-after-free race condition in AFD.sys, the driver handling network sockets in the Windows kernel, and was the only flaw in this the August Patch Tuesday release Microsoft flagged as under active exploitation.
The activity is the latest wave of Operation Dream Job, which approaches employees at defense firms with fraudulent job offers.
Targets included organizations working on surveillance sensors, drones and robotics, with activity or targeting in France, Germany, Brazil and India.
Four Keys and a Layered Handshake
Infection ran through MISTPEN, an in-memory downloader that communicates via attacker-controlled files on OneDrive using the Microsoft Graph API. After reconnaissance and persistence stages, it loaded a dedicated module to fetch the privilege escalation exploit.
That module fingerprinted the host, then requested four public keys from the command server. It used them to generate fresh key material with Kyber/ML-KEM, the key encapsulation scheme NIST standardized in 2024 to resist attack by quantum computers, returning the encapsulated result before requesting the exploit itself, which it decrypted and ran in memory.
Traffic through that channel carried a second encryption layer using GOST-CBC, on top of MISTPEN’s own AES transport encryption.
What arrived through the handshake was FudModule, Lazarus’s kernel rootkit, in a build Check Point tracks as v3.1.It disables telemetry callbacks, removes minifilters, kills the NT Kernel Logger and blinds 94 Event Tracing for Windows (ETW) providers. Newly added is tampering with Smart App Control, resetting its policy state and forcing a code integrity reload.
Command and Control on Borrowed Servers
The group ran its infrastructure almost entirely on machines it did not own, using Roundcube webmail servers exploited through CVE-2025-49113 with credentials likely sourced from dark web leaks, alongside compromised PrestaShop sites.
Each hosts RelayShell, a previously undocumented PHP webshell that acts as a message relay rather than a conventional command shell, passing traffic between operator and victim through session files. Check Point found evidence of at least 17 compromised relay servers.
Delivery has also shifted. The group built at least three websites impersonating privacy technology vendor Enveil, some ranking top in search results.
Check Point stressed Enveil was neither targeted nor compromised. Those sites distributed a trojanized PDF viewer that runs a payload hidden inside crafted documents, delivering Troy, a previously undocumented backdoor supporting 17 operator commands.
