For roughly five weeks this summer, North Korea’s Lazarus Group had a working key to the deepest layer of Windows and nobody outside the group knew it. Microsoft closed that door on August 11, 2026, patching CVE-2026-68820, a use-after-free flaw in the Ancillary Function Driver for WinSock (AFD.sys) that state-linked hackers had already turned into a loader for an upgraded version of their FudModule rootkit. Check Point Research, which caught the campaign and reported it to Microsoft, published its findings under the title “Shattering the Dream: When a Job Offer Becomes a Zero-Day Attack,” tying the exploit to a fake-recruiter phishing operation aimed at defense and aerospace employees in Europe, India, and Brazil.
The vulnerability itself carries a CVSS score of 7.0, a figure Microsoft’s own MSRC advisory reaffirmed as of August 2026, rated Important rather than Critical. That number understates the danger. CVE-2026-68820 is the third time in roughly two years that Lazarus has burned a Windows kernel driver zero-day to deploy FudModule, and the second time the group has picked the exact same driver family, AFD.sys, to do it. CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day Microsoft shipped the fix, starting a federal patch clock that expired on August 25, 2026, and as of September 2026, security-ratings tracker UpGuard still lists the CVE’s status as “Active exploitation” rather than resolved. For CISOs, the story is no longer about one CVE. It is about a threat actor that has industrialized kernel-level privilege escalation and is running out the same playbook against the same category of target, year after year.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Is CVE-2026-68820? Inside the AFD.sys Flaw
AFD.sys, the Ancillary Function Driver for WinSock, is a kernel-mode component that every Windows machine relies on to run the Windows Sockets API, the plumbing behind nearly all network communication on the operating system. CVE-2026-68820 is a use-after-free bug in that driver: an attacker who already has local, authenticated access to a machine can trigger a race condition that lets them manipulate freed memory and escalate from a standard user context to SYSTEM privileges. Tenable’s analysis of the August 2026 Patch Tuesday batch confirms the CVSS v3.1 base score of 7.0 and notes it was the only flaw in that month’s release that Microsoft flagged as under active exploitation at time of disclosure.
Because the bug requires local access first, it is not a remote-code-execution monster on paper. In practice, that distinction barely matters. Once an attacker has landed a foothold through phishing or social engineering, a reliable local privilege escalation bug is exactly what turns a single infected laptop into full administrative control of the machine, and from there into a platform for disabling security tooling. That is precisely the sequence Check Point documented: initial access through a trojanized application, then CVE-2026-68820 as the elevation step, then FudModule as the payload that erases the attacker’s tracks.
The NVD entry for CVE-2026-68820, published by NIST on 11 August 2026, lists the affected footprint as sweeping. SentinelOne’s own tracking, current as of August 2026, enumerates four affected Windows 10 builds (1607, 1809, 21H2, and 22H2), four Windows 11 builds (23H2, 24H2, 25H2, and 26H1), and six Windows Server releases (2012, 2012 R2, 2016, 2019, 2022, and 2025), including Server Core installations. In other words, almost any Windows endpoint or server still receiving security updates was exposed until the patch landed.
How Lazarus Weaponized the Bug: Operation Dream Job, Again
The infection chain Check Point traced back to Lazarus’s long-running Operation Dream Job playbook, the same fake-recruiter approach the group has used against defense contractors, aerospace engineers, and cryptocurrency developers for several years. Targets are approached, often on professional networking platforms, with a plausible job offer or freelance contract. The conversation eventually moves to a file: in this campaign, a trojanized PDF viewer bundled with a backdoor Check Point calls Troy. Once the malware executes, it does not touch the kernel right away. It first establishes a foothold and evaluates the target, and only then reaches for CVE-2026-68820 to elevate privileges and load FudModule.
What distinguishes this campaign from Lazarus’s earlier kernel exploits is what the group did not need to do. Historically, Lazarus and other advanced groups have leaned on Bring Your Own Vulnerable Driver, or BYOVD, attacks: dropping a legitimate, signed third-party driver that happens to have a known flaw, then abusing that flaw to cross from user mode into kernel mode while bypassing Driver Signature Enforcement. BYOVD works, but it is noisy. Security products increasingly maintain blocklists of known-vulnerable drivers specifically to catch this technique. By finding a fresh zero-day inside a driver that ships with Windows itself, Lazarus skipped the noisy step entirely. There was no suspicious third-party driver for an EDR product to flag, because the vulnerable code was already sitting on every Windows machine on the planet.
FudModule v3.1: North Korea’s Kernel Rootkit, Explained
FudModule was first publicly named and analyzed by Kaspersky in 2022, in research documenting a Lazarus-linked campaign that used a data-only kernel rootkit to hook and disable Windows security monitoring without loading traditional, more detectable kernel code. Since then, FudModule has become Lazarus’s signature tool for the final stage of a kernel-level intrusion: once the group has SYSTEM-level access, FudModule manipulates kernel objects and security telemetry so that EDR agents, event logging, and other defensive controls either stop reporting accurately or stop reporting at all.
The version deployed in the August 2026 campaign, which Check Point tracks as FudModule v3.1, is described as an upgraded build rather than a ground-up rewrite. That incremental pattern, refine the rootkit, then pair it with a fresh kernel primitive, has been the group’s approach since at least early 2024. It suggests a mature, well-resourced development operation rather than opportunistic tinkering: Lazarus treats FudModule the way a commercial vendor treats a product line, iterating on stealth capability while periodically shopping for a new zero-day to deliver it.
Three Continents, One Sector: Who Got Targeted
Check Point’s disclosure describes victims concentrated in defense and aerospace organizations across Europe, India, and Brazil, consistent with Lazarus’s long-standing interest in weapons design data, satellite and propulsion engineering, and geopolitical intelligence that can be repackaged for North Korea’s own military programs. The geographic spread is notable on its own. Rather than a single regional campaign, this was a coordinated effort spanning three continents, using the same infection chain, the same backdoor, and the same rootkit build against a narrow, high-value professional population: engineers and program staff at firms with defense or aerospace contracts.
That targeting pattern also explains why the flaw stayed hidden for so long. A wide-net ransomware crew wants volume and gets noticed fast because it hits thousands of machines. A nation-state espionage operation wants precision and quiet, deploying against a few dozen or a few hundred carefully selected targets, which is exactly the profile that lets a kernel zero-day survive in the wild for five weeks before a security vendor catches it.
Timeline: From First Exploitation to Patch Tuesday
Reporting on the campaign places first observed exploitation roughly five weeks before Microsoft’s fix, putting the earliest known attacks in early July 2026. Check Point’s responsible disclosure process ran through late July and early August, giving Microsoft time to build, test, and stage a fix for the August cycle rather than issuing an emergency out-of-band patch. Microsoft’s August 2026 Patch Tuesday landed on August 11, 2026, and CVE-2026-68820 was bundled into that release as the one flaw the company explicitly flagged as already under active attack.
Counting the total size of that Patch Tuesday batch depends on which tracker you ask. The Hacker News and Tenable both put the Microsoft-only count at 398 CVEs, vulnerability-management vendor Greenbone counted 420 new CVEs disclosed in that same August 2026 batch, and Check Point’s own weekly threat intelligence report counted 421 vulnerabilities patched across Windows, Office, SharePoint, Exchange Server, and Azure combined, including third-party components bundled into Microsoft products. Whichever figure is used, CVE-2026-68820 was a small line item in a very large release, which is exactly why CISA’s same-day KEV addition mattered: it told defenders which single line in a 400-item patch list needed to jump the queue.
Lazarus’s Kernel Zero-Day Pattern: Three Strikes in Two Years
CVE-2026-68820 is not an isolated event. It is the third publicly documented Windows kernel zero-day Lazarus has burned to deploy FudModule since February 2024, and the second time the group has specifically targeted AFD.sys. The pattern is laid out below.
| CVE | Driver Targeted | Disclosed | CVSS | Technique | Outcome |
|---|---|---|---|---|---|
| CVE-2024-21338 | appid.sys (AppLocker) | February 2024 | 7.8 | Admin-to-kernel IOCTL abuse, no third-party driver needed | Kernel read/write primitive, updated FudModule loaded |
| CVE-2024-38193 | afd.sys (WinSock) | August 2024 | 7.8 | BYOVD-style kernel elevation | FudModule reinstalled, EDR visibility disabled |
| CVE-2026-68820 | afd.sys (WinSock) | August 2026 | 7.0 | Use-after-free race condition, built-in driver only | FudModule v3.1 deployed, ~5-week exploitation window |
The trajectory across those three incidents is a shift away from third-party BYOVD toward built-in Windows components. In February 2024, security researcher Jan Vojtěšek at Avast caught Lazarus abusing appid.sys, the driver behind Windows AppLocker, in what researchers at the time described as an admin-to-kernel escalation rather than a classic BYOVD chain. Six months later, in August 2024, Lazarus moved to AFD.sys for the first time with CVE-2024-38193, also rated CVSS 7.8. Two years after that, the group returned to the same driver family with CVE-2026-68820. Three different kernel primitives, one consistent rootkit payload, and a defender’s environment (Windows) that keeps providing fresh entry points.
CISA’s KEV Deadline and the BOD 26-04 Squeeze
CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog on the same day Microsoft published the fix, August 11, 2026, with vulnerability tracker Greenbone independently corroborating the KEV listing at the same CVSS 7.0 severity, and set enforcement under Binding Operational Directive 26-04, the agency’s framework for prioritizing security updates by exploitation risk. Qualys published detailed compliance guidance a week later, on August 18, 2026, pinning the actual fixes to KB5121003 for Windows 11, which advances builds to 26200.9168, and KB5120249 for Windows 10, which advances builds to 26100.9168, and noting that for internal, non-internet-exposed Windows endpoints, the remediation deadline landed 14 days out, on August 25, 2026. That is a tight window for any organization running fleets numbering in the thousands of endpoints, particularly ones bound by change-control processes that were not designed to turn around emergency kernel driver patches inside two weeks.
For federal civilian agencies, the KEV listing is not optional guidance, it is a compliance requirement with an audit trail. For everyone else, it functions as the industry’s de facto priority signal: when CISA adds a CVE to KEV on day zero of the patch, security teams outside government treat that as confirmation the exploit is already circulating and not just theoretical, which is exactly why patch management vendors moved so fast to publish their own guidance in the days that followed.
How the Security Industry Responded
The response to CVE-2026-68820 played out across several vendors within days of the patch, each filling a different piece of the picture for defenders trying to triage the news.
| Organization | Action Taken | Date |
|---|---|---|
| Microsoft | Shipped patch for CVE-2026-68820, rated Important, CVSS 7.0 | August 11, 2026 |
| CISA | Added CVE-2026-68820 to the Known Exploited Vulnerabilities catalog | August 11, 2026 |
| Check Point Research | Published “Shattering the Dream” disclosure, attributing the campaign to Lazarus | August 2026 |
| CrowdStrike | Flagged the flaw as actively exploited in its monthly Patch Tuesday analysis | August 2026 |
| Tenable | Confirmed exploitation status and urged prioritized patching in its own breakdown | August 2026 |
| Qualys | Published BOD 26-04 compliance guidance with specific remediation deadlines | August 18, 2026 |
CrowdStrike’s Patch Tuesday writeup singled out CVE-2026-68820 as the release’s most urgent single item despite its comparatively modest 7.0 score, on the grounds that active exploitation against a real threat actor’s target list matters more to a defender’s prioritization than the raw severity number. That view has become close to consensus in enterprise patch management over the last two years, as CISOs increasingly weight the KEV catalog and exploitation-in-the-wild status above CVSS alone when deciding what gets patched first.
BYOVD vs. Built-In Driver Abuse: Why the Shift Matters
Bring Your Own Vulnerable Driver attacks have been a known quantity in enterprise security for years now. Microsoft maintains a driver blocklist, EDR vendors maintain their own, and a cottage industry of tools exists specifically to detect a newly dropped, signed-but-flawed driver appearing on an endpoint that has no business having one. That defensive maturity is exactly why Lazarus’s pivot toward zero-days in components that already ship with Windows is significant. There is no anomalous driver to flag. There is no unusual file drop to catch. The vulnerable code has been sitting on every patched and unpatched Windows machine in the world, waiting.
Practically, that means detection has to shift further left, toward catching the initial phishing lure and the malware that lands before privilege escalation happens, because the escalation step itself is increasingly hard to catch with signature-based driver monitoring alone. It also means the value of a zero-day inside a core Windows kernel driver has gone up for a group like Lazarus: a single well-placed AFD.sys bug is worth more to the group’s operational security than another disposable BYOVD chain, because it leaves no forensic trail pointing at a suspicious third-party file.
Security teams auditing exposure to this class of attack can start by checking installed patch levels against Microsoft’s official advisory. A simple PowerShell check against the relevant KB confirms whether an endpoint received the August 11, 2026 update:
Get-HotFix | Where-Object {$_.Description -eq "Security Update"} | `
Where-Object {$_.InstalledOn -ge (Get-Date "2026-08-11")} | `
Select-Object HotFixID, InstalledOn
# Cross-check against Microsoft's advisory for CVE-2026-68820
# and confirm afd.sys build number matches the patched version
Get-Item "C:\Windows\System32\drivers\afd.sys" | `
Select-Object VersionInfoBeyond patch verification, defenders should treat kernel-driver tamper protection, application allow-listing, and phishing-resistant multi-factor authentication as complementary controls, since none of them alone would have stopped this specific chain, but combined they raise the cost of each stage from initial phishing lure through kernel escalation.
The Bybit Shadow: Why Lazarus Keeps Investing in Zero-Days
It is worth remembering what Lazarus’s other business line looks like. In February 2025, hackers attributed to the group stole approximately $1.5 billion in Ethereum and related tokens from the Dubai-based exchange Bybit, the largest cryptocurrency theft ever recorded. Chainalysis later calculated that crypto theft across all threat actors reached $3.4 billion in 2025, with North Korea-linked groups responsible for $2.02 billion of that total, a 51% year-over-year increase in DPRK-attributed theft. The Bybit heist alone accounted for roughly 44% of everything stolen from private wallets worldwide that year, according to the same research.
That scale of resourcing helps explain why Lazarus can afford to burn a genuine kernel zero-day on an espionage campaign rather than reserving it for financially motivated operations. A group funding weapons and missile programs with stolen cryptocurrency has both the budget to acquire or discover new exploits and the institutional patience to develop a five-week-long targeted campaign against defense engineers rather than rushing a smash-and-grab. The connection between the group’s financial crime arm and its espionage arm is not incidental. Both draw on the same pool of malware development, the same social-engineering infrastructure, and increasingly, the same appetite for kernel-level access.
Historical Context: Twelve Years of Lazarus Escalation
Lazarus Group has been a fixture of nation-state threat reporting since it was tied to the 2014 breach of Sony Pictures Entertainment, an attack that combined data theft with the destruction of a large share of the studio’s endpoints in retaliation for the film “The Interview.” In the years since, the group’s toolkit has moved from destructive wiper malware and data theft toward a dual-track model: state-directed espionage against defense, aerospace, and government targets on one side, and increasingly sophisticated cryptocurrency theft to fund those operations and North Korea’s weapons programs on the other.
The kernel rootkit work that culminated in this month’s CVE-2026-68820 campaign traces back at least to 2022, when Kaspersky first documented FudModule. What has changed since then is not the rootkit’s fundamental purpose, disabling security telemetry once SYSTEM access is achieved, but the group’s consistency in finding fresh kernel primitives to deliver it. Three zero-days in a Microsoft operating system component over roughly two and a half years, each one patched, each one followed by continued development rather than abandonment of the underlying tool, describes an adversary with sustained access to vulnerability research capability that most private-sector red teams would envy.
Market and Enterprise Impact
The immediate operational impact of CVE-2026-68820 fell hardest on defense and aerospace IT security teams, who had to move fast on the compressed BOD 26-04 timeline while also auditing whether any of their engineering staff had been contacted through the Operation Dream Job lure in the preceding weeks. For managed security providers and EDR vendors, the campaign reinforces a sales argument that has been building since Lazarus’s earlier AFD.sys and appid.sys campaigns: kernel-level tamper protection and driver-integrity monitoring are no longer optional add-ons for regulated, high-value sectors, they are baseline expectations from defense-sector customers and their government auditors.
There is also a compliance dimension that extends beyond the immediate patch window. Defense contractors operating under frameworks like CMMC in the United States or equivalent national security clearance regimes in Europe and India increasingly treat confirmed nation-state targeting, even unsuccessful targeting, as a reportable event that can trigger contract-level security reviews. A campaign spanning three continents against a single professional category gives program auditors a concrete, dated incident to reference the next time they assess whether a contractor’s endpoint protection program meets current threat expectations.
Predictions: Where This Goes Next
- Expect at least one more Lazarus-attributed Windows kernel driver zero-day within the next 12 to 18 months, continuing the roughly annual cadence the group has kept since 2024, likely again targeting a built-in driver rather than a third-party BYOVD candidate.
- CISA’s tiered BOD 26-04 deadline model, with shorter windows for internet-exposed assets and a 14-day window for internal endpoints, is likely to become the template applied to future nation-state KEV additions rather than a one-off response.
- Defense and aerospace contractors should anticipate tighter mandatory reporting requirements around confirmed targeted phishing campaigns, even absent evidence of successful compromise, as auditors increasingly treat targeting itself as a security-posture signal.
- Kernel driver allow-listing and tamper-protection features, already standard in premium EDR tiers, are likely to migrate into baseline enterprise security packages as this class of built-in-driver attack becomes more common across multiple threat actors, not just Lazarus.
- Operation Dream Job-style fake recruiter lures will keep working against defense-adjacent engineering staff for the foreseeable future, since the underlying social pressure, a plausible job offer during uncertain economic conditions, remains difficult to train away entirely.
What Defenders Should Do Now
Organizations that have not yet confirmed patch deployment for CVE-2026-68820 should treat it as overdue rather than urgent at this point, given the August 25, 2026 federal deadline has already passed. Beyond confirming the patch, security teams in defense-adjacent sectors should specifically review inbound recruiting and freelance-contract communications from the past two months for signs of the trojanized PDF viewer and Troy backdoor pattern Check Point documented, and should confirm that EDR tooling includes kernel driver integrity monitoring rather than relying solely on signature-based third-party driver blocklists, since this campaign was specifically engineered to avoid triggering that category of detection.
The broader lesson from three Lazarus kernel zero-days in two and a half years is less about any single patch and more about patch prioritization discipline. A CVSS 7.0 bug buried in a list of 398 or 421 fixes, depending on whose count you use, looks unremarkable on paper. The KEV listing, the named threat actor, and the specific rootkit payload are what should move it to the top of the queue, and organizations that patch by CVSS score alone rather than by exploitation status are, by definition, patching Lazarus’s targets last.
Frequently Asked Questions
What is CVE-2026-68820?
It is a use-after-free elevation-of-privilege vulnerability in AFD.sys, the Windows Ancillary Function Driver for WinSock, with a CVSS v3.1 base score of 7.0. Microsoft patched it on August 11, 2026, after confirming active exploitation.
Who exploited CVE-2026-68820?
Check Point Research attributed the exploitation to North Korea’s Lazarus Group, used as part of an Operation Dream Job-style fake recruiter phishing campaign against defense and aerospace employees in Europe, India, and Brazil.
What is FudModule?
FudModule is a Windows kernel-mode rootkit first publicly documented by Kaspersky in 2022 and consistently linked to Lazarus Group operations since. It manipulates kernel objects and security telemetry to blind EDR tools and other defensive monitoring once an attacker has SYSTEM-level access.
Is this the first time Lazarus has exploited AFD.sys?
No. Lazarus previously exploited a different AFD.sys flaw, CVE-2024-38193, in August 2024 to deploy an earlier FudModule build. CVE-2026-68820 marks the second AFD.sys zero-day the group has used for this purpose in roughly two years.
How long was CVE-2026-68820 exploited before the patch?
Security researchers place the earliest observed exploitation at roughly five weeks before Microsoft’s August 11, 2026 patch, putting the start of the campaign in early July 2026.
What is the CISA KEV deadline for this vulnerability?
CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog on August 11, 2026, the same day the patch shipped. Under Binding Operational Directive 26-04, internal, non-internet-exposed Windows endpoints faced a 14-day remediation deadline of August 25, 2026.
Does this affect all versions of Windows?
The NVD advisory lists affected versions spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H1, and Windows Server 2012 through 2025, including Server Core installations, meaning the vast majority of actively supported Windows systems were exposed prior to patching.
How is this different from a typical BYOVD attack?
Bring Your Own Vulnerable Driver attacks involve dropping a legitimate but flawed third-party driver to reach the kernel, which security tools can flag through driver blocklists. CVE-2026-68820 exploited a flaw already present in a driver that ships with Windows itself, leaving no anomalous third-party file for defenders to detect.
Related Coverage
- McKesson Confirms Breach: 284M Records, $55M Demand [2026]
- Set Up Content Security Policy: 12 Steps, 90 Min [2026]
- How to Encrypt Files: 12 Steps, 90 Min [2026]
- Berlin Confirms Data Theft After Rhysida Attack: 5.79TB [2026]
- Firewall Security Is Really About Controlling Trust Paths
