Lazarus AFD.sys / ForestTiger & Troy — Operation Dream Job Resurgence

Check Point Research disclosed a resurgence of Lazarus Group's (DPRK-linked) "Operation Dream Job" campaign, publicly reported 2026-08-11. The attacker's objective is to gain a durable, SYSTEM-level foothold on defense, aerospace, and aviation-sector endpoints in Europe, India, and Brazil (with confirmed activity in France, Germany, Brazil, and India) by combining a fake-recruiter social-engineering lure with a previously undocumented Windows kernel zero-day.

Victims are approached with fraudulent recruiter messages (impersonating Lockheed Martin and the privacy-tech firm Enveil) and directed to download either an encrypted archive containing a legitimate PDF viewer plus a malicious sideloaded DLL (libmupdf.dll), or a fully trojanized PDF viewer branded "SecurityPDF." Either chain launches MISTPEN, an in-memory downloader that abuses the Microsoft Graph API / OneDrive for staging, which in turn triggers CVE-2026-68820 — a use-after-free race condition in afd.sys (Windows Ancillary Function Driver for WinSock) — to escalate to SYSTEM and deploy FudModule v3.1, a kernel-mode rootkit that strips ETW providers, minifilters, the NT Kernel Logger, and (new in v3.1) tampers with Smart App Control. Post-exploitation, the actor deploys the previously undocumented ForestTiger persistence backdoor and the newly identified Troy modular backdoor (17 commands: file browsing/exfiltration, command shell, in-memory DLL/process injection). C2 and relay traffic rides compromised Roundcube (CVE-2025-49113), WordPress, and PrestaShop infrastructure via a new PHP webshell, RelayShell, fronted by commercial VPN services (ExpressVPN observed).

Microsoft patched CVE-2026-68820 in the August 2026 Patch Tuesday release (2026-08-11); CISA added it to the KEV catalog the same day with a federal remediation due date of 2026-08-25. The kernel exploit itself generates little direct EDR telemetry — detection in this pack leans on the surrounding behavioral chain (lure execution, DLL sideload, SYSTEM-context anomalies, backdoor C2 patterns) plus the atomic IOCs Check Point published, rather than the UAF trigger itself.

Total patch count discrepancy note: secondary sources report Microsoft's August 2026 cycle variously as ~398 and ~421 CVEs, likely due to differing inclusion of third-party (e.g. Chromium/Edge) advisories in each outlet's count. This does not affect CVE-2026-68820's own details, which are consistent across every source.

Untrusted-content check: every fetched page was treated as data, not instruction. No page contained text addressed to "the AI agent," attempted to redirect this task, or claimed agent-directed authority. Nothing was found requiring escalation.

Hunt hypotheses (ordered by fidelity)

1. H1 — Known-bad hash presence. Any confirmed campaign hash (MISTPEN/ForestTiger/Troy/FudModule/RelayShell/SecurityPDF/loader/PDF-payload) appears on a Falcon-monitored endpoint. MITRE: T1587.001, T1204.002. Confidence: high.
2. H2 — Known C2/lure infrastructure contact. DNS or network connection to envell[.]xyz, enveil[.]online, uxtramine[.]org, or 135.181.67[.]203 / 135.181.185[.]158. MITRE: T1071.001, T1583.001. Confidence: high.
3. H3 — SecurityPDF trojanized-viewer chain. A process named SecurityPDF.exe launches a child named new.exe from a temp path (the XOR-decrypted embedded payload). MITRE: T1204.002, T1027, T1055. Confidence: high.
4. H4 — DLL sideloading via libmupdf.dll. A malicious libmupdf.dll is written/loaded alongside a legitimate-looking PDF viewer from a non-Program-Files path. MITRE: T1574.001. Confidence: medium.
5. H5 — MISTPEN-style Graph API/OneDrive staging. A non-Microsoft, non-browser process resolves graph.microsoft.com / *.onedrive.com. MITRE: T1102.002, T1567.002. Confidence: medium.
6. H6 — AFD.sys LPE-to-SYSTEM anomaly. A SYSTEM-context msiexec.exe spawns an unexpected child shortly after a non-elevated user session on the same host — a candidate signature for the CVE-2026-68820 → FudModule staging pattern Check Point documented (SYSTEM-level msiexec.exe-hosted stage). MITRE: T1068, T1055. Confidence: medium (behavioral only — the kernel UAF itself is not directly observable in EDR process/file/network telemetry).
7. H7 — RelayShell webshell command execution. A web-server worker process (php-cgi/httpd/w3wp/nginx) spawns a command shell. MITRE: T1505.003, T1059.003. Confidence: medium.
8. H8 — Job-lure archive-to-execution chain. A browser/messaging/mail client spawns an archive utility that is shortly followed by execution of an unsigned binary from Downloads/Temp. MITRE: T1566.002, T1204.002. Confidence: medium (high FP without lure-keyword correlation).

Attack chain

Representative sample below; the complete 40-hash / 3-domain / 2-IP set (verified verbatim against Check Point's own published IOC appendix, cross-checked independently against CyberPress's reproduction) ships in the machine-readable appendix (§10) and is used in full in Q1/Q2 (§8).

Windows patch/KEV compliance (Event Log / WMI, no EDR required)

Confirm CVE-2026-68820 remediation status on every Windows 10/11/Server host — the KEV due date (2026-08-25) applies whether or not the host is Falcon-monitored.

Get-HotFix | Where-Object { $_.HotFixID -match 'KB\d+' } |
  Sort-Object InstalledOn -Descending | Select-Object -First 20
# Cross-reference installed cumulative update build number against the
# August 2026 Patch Tuesday release for your Windows 10/11/Server SKU.
# Absence of the August 2026 CU after 2026-08-25 = KEV / BOD 26-04 breach.

Mail / messaging gateway — job-offer lure detection

• Search inbound mail and messaging-platform logs (Teams, Slack, WhatsApp Business API gateways where logged) for external senders using recruiter-themed language referencing Lockheed Martin, Enveil, or generic "job opportunity / position available" phrasing paired with a link to an external file-hosting or archive download.
• Flag ZIP/RAR attachments or download links delivered via personal/unofficial messaging channels to employees in defense, aerospace, or aviation business units.
• Correlate with HR/recruiting team confirmation — a real recruiter contact from an unlisted external domain claiming to represent a known defense contractor is a strong lure indicator.

Sysmon cross-check (where Sysmon runs alongside or instead of Falcon)

• Event ID 1 (process creation): ParentImage ending in SecurityPDF.exe with Image ending in new.exe under a Temp path — mirrors Q3.
• Event ID 7 (image/DLL load): ImageLoaded ending in libmupdf.dll from a path outside Program Files — mirrors Q4.
• Event ID 3 (network connection): destination 135.181.67.203 or 135.181.185.158, or DNS query (Event ID 22) for envell.xyz, enveil.online, uxtramine.org.

RelayShell YARA rule (Check Point, verbatim — file-scan or web-server integrity check)

rule lazarus_relayshell {
    meta:
        author = "@_CPResearch_"
        description = "Lazarus RelayShell Webshell"
        target_entity = "file"
        hash = "21c3ad4838c4324bc5f081021da5fb2e9073d0c9304087811c21eb47c9e22762"
    strings:
        $str1 = "PqCWom"
        $str2 = "a84038"
        $str3 = "biwbih"
        $str4 = "ddf7acea"
        $str5 = "enRU904U"
        $str6 = "fou2rm"
        $str7 = "kurhiW"
        $str8 = "qcrgl"
        $str9 = "rlzbiw"
        $str10 = "tmmvr1"
        $str11 = "win386"
    condition:
        3 of ($str*)
}

Run this YARA rule against web-server filesystems (PHP file scan) for Roundcube/WordPress/PrestaShop hosts under your management — RelayShell is the relay-node implant, not an endpoint payload.

Hash and infrastructure matches (Q1/Q2) belong in Falcon IOC Management (§10 grab-csv) as direct indicator imports, not as behavioral Custom IOAs. The following behavioral queries are IOA-promotion candidates after the baseline period in §11:

Do not promote Q5, Q7, or Q8 to Custom IOA — their FP profile (high, or dependent on org-specific CMS/deployment context) makes them better suited to scheduled hunt queries with analyst triage than automated IOA firing.

Playbook A — CVE-2026-68820 patch-compliance sweep (PowerShell, fleet-wide)

Prerequisites: WinRM/remote PowerShell access to target hosts, or deployment via existing RMM/SCCM/Intune script channel. Reboot required: No (this is a read-only audit; the underlying patch install itself does require a reboot — schedule separately per your maintenance window). Rollback: none required — read-only compliance check, makes no system changes.

$targetKB = "August 2026 Cumulative Update"  # substitute the specific KB for each Windows SKU in your fleet
$result = Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 15
$buildNum = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuildNumber
Write-Output "Host: $env:COMPUTERNAME | Build: $buildNum"
Write-Output ($result | Format-Table -AutoSize | Out-String)
# Compare $buildNum and most-recent KB InstalledOn date against your organization's
# August 2026 Patch Tuesday release notes for the applicable Windows 10/11/Server SKU.
# Flag any host without the August 2026 CU as NON-COMPLIANT / KEV-EXPOSED.

Playbook B — WDAC/AppLocker rule: block unsigned execution from Temp/Downloads with PDF-viewer exception

Prerequisites: pilot ring identified, AppLocker or WDAC already enabled in audit mode on target hosts, IT-approved PDF viewer publisher certificate details on hand. Reboot required: No (AppLocker policy refresh applies live via gpupdate /force or WDAC policy refresh; a reboot is only needed if enforcing WDAC in a mode that requires it — confirm for your deployment method). Rollback: revert to the prior AppLocker/WDAC policy XML (keep a versioned backup before applying) and re-run gpupdate /force — no persistent system-state change beyond the policy itself.

<!-- AppLocker: deny unsigned .exe execution from user-writable Temp/Downloads paths -->
<FilePathRule Id="REPLACE_WITH_GUID" Name="Deny-Unsigned-Exe-TempDownloads"
              Description="Blocks unsigned executables launched from Temp/AppData/Downloads (Operation Dream Job payload-drop pattern)"
              UserOrGroupSid="S-1-1-0" Action="Deny">
  <Conditions>
    <FilePathCondition Path="%OSDRIVE%\Users\*\AppData\Local\Temp\*.exe" />
  </Conditions>
</FilePathRule>
<FilePathRule Id="REPLACE_WITH_GUID_2" Name="Deny-Unsigned-Exe-Downloads"
              UserOrGroupSid="S-1-1-0" Action="Deny">
  <Conditions>
    <FilePathCondition Path="%OSDRIVE%\Users\*\Downloads\*.exe" />
  </Conditions>
</FilePathRule>
<!-- Pair with an Allow rule scoped to your IT-approved, signed PDF viewer publisher -->
# Deploy to a pilot ring in Audit-Only mode first; review AppLocker event log (8003/8004)
# for 14 days before switching to Enforce.
gpupdate /force

Playbook C — Falcon Sensor Visibility Exclusions audit (FudModule ETW/minifilter tamper detection)

Prerequisites: Falcon Console access with IOC Management / Sensor Visibility Exclusions read permission. Reboot required: No. Rollback: none required — this is a review/reporting step, no configuration is changed.

# In Falcon Console: Host setup and management -> Sensor visibility exclusions
# Export the current exclusion list and diff against the last known-good baseline weekly.
# Any new exclusion added outside a documented change-control ticket is a FudModule-class
# defense-evasion indicator and should trigger immediate investigation of the requesting host.
#
# Falcon CQL cross-check (informational — sensor-exclusion events are console-side,
# not queryable via LogScale process telemetry):
# REPLACE_WITH_TENANT_SPECIFIC: if your tenant exposes sensor-config-change events to
# LogScale, add a query here matching that event type once confirmed available.

Validation gates (§11) apply before any of the "Partial"/candidate rows above are promoted to alerting. The two hard GAPs — the kernel exploit itself and the initial social-engineering channel — are structural: no EDR product observes a kernel-mode UAF race condition or a LinkedIn DM directly. Coverage for both depends on patching (removes the exploit) and user training/mail-gateway hunts (removes the lure), not CQL.