Lazarus Combines Social Engineering and CVE-2026-68820 Windows Privilege-Escalation Flaw for Espionage

Operation Dream Job is a long-running cyber attack campaign operated by the Lazarus Group [1][2], a prolific North Korean APT threat actor. The group is known for targeting defense, aerospace, and aviation organizations across Europe, Asia, and South America since at least 2016, potentially as far back as 2009 or earlier. Public reporting has often used the name “Lazarus” loosely to describe a wide range of hacking groups associated with North Korea. In recent years, North Korean threat actors have exploited employment as a means of infiltrating organizations using stolen or fabricated identities, and as a trap for compromising job seekers as part of broader social engineering campaigns.

In the most recent campaigns, attackers are using fake job interviews to trick victims into opening malicious documents or installing trojanized PDF readers for initial access. Once inside, attackers exploit a recently disclosed Windows flaw, CVE-2026-68820, for local privilege escalation and rootkit installation. The campaign has also leveraged CVE-2025-49113 to compromise Roundcube servers for use as command-and-control (C2) relays. Both CVE-2026-68820 and CVE-2025-49113 are on CISA’s Known Exploited Vulnerabilities (KEV) list [1][2].

Greenbone’s OPENVAS ENTERPRISE FEED includes registry analysis detection for CVE-2026-68820 in Windows Server 2025, Windows Server 2022, Windows Server 2019, Windows 11, and Windows 10, and regular detection for Microsoft vulnerabilities. The ENTERPRISE FEED also includes Linux package-level detection and remote banner detection for CVE-2025-49113 affecting Roundcube Webmail since soon after its disclosure and regular detection for Roundcube vulnerabilities.

Grabbing a copy of OPENVAS SCAN with a free two-week trial of the OPENVAS ENTERPRISE FEED is a surefire way to gain the deepest insight into software vulnerabilities in your organization’s IT infrastructure.

Understanding the Recent Operation Dream Job Campaign

According to Check Point, the latest Operation Dream Job wave targets professionals and organizations in the defense sector for espionage. Attackers installed malware modules capable of capturing and exfiltrating screenshots, and stealing selected files.

First-stage social engineering attacks involve impersonation of job recruiters and presenting fake job offers to lure victims into opening malicious files [T1204.002] or installing trojanized PDF viewers [T1204]. Attackers then deploy malware including MISTPEN, ForestTiger, and a malicious DLL implant [T1055.001] dubbed Troy, which was previously unknown.

After gaining initial access, attackers exploited CVE-2026-68820, disclosed in Microsoft’s August patch release, for privilege escalation [TA0004]. Elevated privileges are then used to deploy a Windows rootkit [T1014], evade Endpoint Detection and Response (EDR) tools, and suppress logging [T1685.001][T1685.005]. Roundcube Webmail servers compromised via CVE-2025-49113 are being used as command-and-control relays [T1090.002], helping malicious network traffic appear legitimate to security tools.

Understanding CVE-2026-68820 in Windows AFD.sys

CVSS 7.0 · HighActively exploitedIn CISA KEV

CVE-2026-68820 was first disclosed on August 11th, 2026, in Microsoft’s August Patch Tuesday batch, along with 420 other new CVEs. No public proof-of-concept exploit code is yet available for CVE-2026-68820. However, in recent attacks, Lazarus exploited CVE-2026-68820 for local privilege escalation after gaining initial access. The elevated permissions were used to deploy a Windows rootkit.

Technical Details for CVE-2026-68820

CVE-2026-68820 (CVSS 7.0) is a use-after-free flaw [CWE-416] in afd.sys, the Windows Ancillary Function Driver for WinSock. Exploitation allows local privilege escalation to the SYSTEM level by abusing flawed handling of socket state. When several threads access a socket concurrently, two driver paths can operate on the same state without sufficient synchronization [CWE-362], resulting in an exploitable race condition.

Detailed exploit mechanics are not publicly available. However, a broader pattern of afd.sys weaknesses is also evident. Several documented examples involve race conditions and use-after-free behavior [1][2][3][4][5][6].

Mitigating CVE-2026-68820 in Windows AFD.sys

Organizations should apply Microsoft’s August 2026 security updates to Windows systems as soon as possible. Greenbone’s OPENVAS ENTERPRISE FEED includes registry analysis detection for CVE-2026-68820 in Windows Server 2025, Windows Server 2022, Windows Server 2019, Windows 11, and Windows 10, and regular detection for Microsoft vulnerabilities. Given the actively exploited status of CVE-2026-68820, security teams should monitor for suspicious SYSTEM-level activity that may indicate a security breach.

Understanding CVE-2025-49113 in Roundcube Webmail

CVSS 8.8 · HighActively exploitedIn CISA KEVPublic PoC

CVE-2025-49113 was published in June 2025. Its release was quickly followed by multiple detailed technical analyses and proof-of-concept exploit samples [1][2][3][4][5][6]. In the Operation Dream Job campaign, compromised Roundcube servers were infected with a PHP web shell and used as relay nodes to hide malicious C2 communication with the victim’s breached computer. Defenders should pay special attention to Roundcube because it has frequently been leveraged in cyber attacks.

Technical Details for CVE-2025-49113

CVE-2025-49113 (CVSS 8.8, EPSS 97.694%, 100th percentile) is a post-authentication remote code execution (RCE) vulnerability. The root cause is flawed PHP object deserialization [CWE-502] that stems from an unvalidated _from parameter in program/actions/settings/upload.php. By supplying malicious input, an authenticated attacker can inject a malicious PHP object that is instantiated during deserialization. Public exploit chains use the Crypt_GPG_Engine class as a gadget: when the object is destroyed, attacker-controlled properties can trigger shell code execution in the context of the web server process.

Mitigating CVE-2025-49113 in Roundcube Webmail

No workaround mitigations for CVE-2025-49113 have been published by the vendor. The primary mitigation is to update affected Roundcube Webmail deployments to a fixed release. Roundcube patched CVE-2025-49113 in the 1.5 LTS and 1.6 branches in June 2025. However, since then, several additional critical-severity CVEs have been identified in Roundcube, which warrants further upgrading.

Also, Roundcube 1.5.x is no longer supported or maintained as of the 1.7.0 release on May 10th, 2026. For ongoing security updates, users should migrate from 1.5.x to Roundcube 1.7.3. Those on the LTS branch should update to 1.6.18. Greenbone’s ENTERPRISE FEED includes Linux package-level detection and remote banner detection for CVE-2025-49113 in Roundcube Webmail since soon after its disclosure and regular detection for Roundcube vulnerabilities. Defenders should pay special attention to Roundcube because it has frequently been leveraged in cyber attacks.

Summary

The latest Operation Dream Job activity combines recruiter-themed social engineering with exploitation of CVE-2026-68820 to escalate privileges and deploy stealth-focused malware on compromised Windows systems. Roundcube Webmail servers exploited via CVE-2025-49113 are being used as relay infrastructure to conceal C2 traffic.

Greenbone’s OPENVAS ENTERPRISE FEED includes registry analysis detection for CVE-2026-68820 in Windows Server 2025, Windows Server 2022, Windows Server 2019, Windows 11, and Windows 10, and regular detection for Microsoft vulnerabilities. Also, the ENTERPRISE FEED includes Linux package-level detection and remote banner detection for CVE-2025-49113 in Roundcube Webmail since soon after its disclosure and regular detection for Roundcube vulnerabilities.

Organizations should prioritize patching both vulnerabilities and monitor for the associated intrusion techniques, particularly in defense, aerospace, aviation, and other high-value environments. Grabbing a copy of OPENVAS SCAN with a free two-week trial of the OPENVAS ENTERPRISE FEED is a surefire way to gain the deepest insight into software vulnerabilities in your organization’s IT infrastructure.