By ByteBot
North Korea’s Lazarus Group spent five weeks silently compromising Windows machines through a kernel-level socket driver bug that Microsoft patched on August 12. CVE-2026-68820, a use-after-free race condition in afd.sys — the driver that handles every socket call your Windows apps make — hands attackers SYSTEM privileges from any low-privileged local account, with no user interaction required. The delivery method: fake LinkedIn recruiter messages dangling “dream job” offers. The payload once inside: a rootkit that blinds over 90 security monitoring channels. Patch Tuesday landed. Patch your machines.
A Kernel Bug in the Socket Layer
afd.sys is the Windows Ancillary Function Driver for WinSock — the kernel-mode component that sits underneath every socket operation your applications make. It operates at a level where no user-space security control can interfere. That is what makes bugs here disproportionately dangerous.
CVE-2026-68820 is a race condition between two threads accessing socket state simultaneously without proper synchronization. An attacker with any existing low-privileged foothold runs a loop that repeatedly triggers the race until one attempt succeeds. When it does, freed memory is accessed before cleanup, yielding a kernel read/write primitive that escalates the attacker straight to SYSTEM. Microsoft rates this as a CVSS 7.0 — Important rather than Critical — because race conditions require timing to exploit. Do not let that score mislead you: this is the only confirmed zero-day in August’s 421-CVE Patch Tuesday, and it was exploited for at least five weeks before the patch existed.
Fake Job Offers, Real Rootkits
Check Point Research, who discovered the campaign and reported it to Microsoft on July 28, published their analysis under an apt title: “Shattering the Dream — When a Job Offer Becomes a Zero-Day Attack.” The attack chain follows a pattern Lazarus has run since 2020 under the name Operation Dream Job, now significantly upgraded.
Operators pose as recruiters on LinkedIn and messaging platforms, eventually sending targets a Lockheed Martin job description or similar defense-sector document alongside downloadable “interview materials.” One of those components is an in-memory module that fires CVE-2026-68820, elevates to SYSTEM, and drops FudModule — Lazarus’s kernel-mode rootkit.
FudModule v3.1, the variant deployed here, is a significant escalation from its predecessors. Where earlier versions targeted Microsoft Defender specifically, v3.1 runs a generic security suppression engine. It strips over 90 ETW (Event Tracing for Windows) providers, disables the minifilter drivers that endpoint detection and response tools depend on for kernel-level visibility, kills the NT Kernel Logger, and tampers with Smart App Control. A machine running this rootkit generates zero alerts. Your EDR solution is not going to catch what it cannot see.
Why Developers Are a Target
Lazarus’s documented targets here are defense and aerospace firms, but developers are not bystanders in this campaign — they are a preferred attack surface. The “coding challenge” delivery mechanism is purpose-built to reach them. Lazarus ran parallel campaigns throughout 2026 seeding malicious npm packages, injecting malicious .vscode/tasks.json files into GitHub repositories, and distributing AI-backdoored coding challenges designed to compromise the machines of engineers who evaluate them.
Developer machines carry API keys, cloud credentials, CI/CD tokens, and direct access to production systems. Landing on a developer’s laptop is often a shorter path to production infrastructure than attacking it directly. That calculation has not been lost on Lazarus.
What to Do Right Now
Apply the August 2026 Patch Tuesday update immediately. For Windows 11 24H2 and 25H2, look for KB5121003. For Windows Server 2019, KB5120238. Verify installation by checking Windows Update history or confirming your build number has advanced.
CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog on August 11 — one day before the patch shipped. Federal agencies have a mandatory remediation deadline under BOD 26-04. If your organization falls under those requirements, the clock is running. If it does not, apply the same urgency regardless.
Beyond patching: treat unsolicited LinkedIn recruiter messages with downloadable attachments the way you treat phishing emails. “Coding challenges” from unknown contacts belong in isolated environments, not your primary development machine. Audit which machines on your network carry elevated local permissions — those are the highest-value targets if any initial access is gained.
