In short: From July 7 to August 11, 2026, North Korea's Lazarus group secretly exploited CVE-2026-68820, a zero-day in the Windows kernel, to elevate privileges to full SYSTEM level and deploy the FudModule 3.1 rootkit. The rootkit blinds Windows security mechanisms from within and remains invisible to most antivirus products. A patch is now available — apply Windows updates immediately.
What happened
On August 11, 2026, as part of the monthly Patch Tuesday, Microsoft fixed CVE-2026-68820 — a critical flaw in the afd.sys system driver (the Ancillary Function Driver for Windows Sockets). On the same day, Check Point Research published a detailed analysis: the North Korean APT group Lazarus had been exploiting this zero-day since at least July 7, giving attackers a five-week head start before any patch existed. During that window, they compromised organisations in the defence, aviation, and aerospace sectors across Europe, India, Brazil, and beyond.
The incident is part of Lazarus's long-running Operation Dream Job campaign, in which the group impersonates recruiters to trick targets into launching malicious files. CVE-2026-68820 is the privilege-escalation step: once a foothold is established, the attackers reach full SYSTEM control. Russian-language coverage was carried by Habr and the security outlet «Хакер». For context on the broader pattern of patched zero-days, see our piece on Microsoft's record July Patch Tuesday.
How CVE-2026-68820 works
The afd.sys driver manages Windows network sockets — virtually all kernel-level network communication flows through it. The vulnerability is a use-after-free flaw: under a specific race condition, memory already freed by the driver continues to be referenced. An attacker with limited local user rights can inject crafted data into that freed memory region to elevate privileges to SYSTEM — the highest access level in Windows.
The CVSS score is 7.0 (High severity). Exploitation requires an initial foothold on the target machine. Lazarus achieved this through Operation Dream Job's proven playbook: a phishing email with a malicious PDF or trojanized software disguised as a recruitment test. Once that file was executed, CVE-2026-68820 converted the limited access into full system control.
FudModule 3.1 — why antivirus cannot detect it
Once SYSTEM privileges are gained, Lazarus deploys FudModule 3.1 — an updated version of the kernel-mode rootkit tracked by researchers since 2022. Operating at the Windows kernel level, it is designed to blind the operating system's own security from within:
- Disables more than 90 ETW (Event Tracing for Windows) providers — the channels through which antivirus and EDR products receive threat signals.
- Kills the NT Kernel Logger, the primary kernel event journal.
- Blocks filesystem minifilters that most antivirus products rely on for real-time scanning.
- Bypasses Smart App Control — Windows's built-in protection against running unverified software.
Once FudModule has disabled kernel telemetry, a standard antivirus sees only silence — it stops receiving the events that would reveal the threat. The compromised machine continues to appear «clean» in most scanners. With a rootkit embedded in the kernel, attackers can read everything: files, browser-stored passwords, encryption keys, messenger conversations, and VPN client data. What happens to stolen credentials once they leave your machine is covered in our report on the billion-password infostealer leak.
Who is at risk — and what it means for your data
The direct targets of this Lazarus campaign are organisations in the defence, aerospace, and aviation sectors — those are the fake job offers being sent under Operation Dream Job. However, the vulnerability CVE-2026-68820 is present on any version of Windows that has not yet received the August patch.
That matters for two reasons. First, once a sophisticated APT technique becomes publicly known, less discriminating criminal groups adopt it and apply it far more broadly. Second, when industrial or government organisations are breached, the personal data of their employees and partners — identification documents, payroll records, correspondence — flows into dark-web markets and fuels targeted phishing against ordinary individuals. To check whether your own credentials have already been exposed, see our guide on protecting accounts from hijacking.
How to protect yourself
Install the August Windows update immediately. Open Windows Update and confirm that the patches released on August 11, 2026 are applied. This closes CVE-2026-68820. If automatic updates are disabled, turn them on now.
Do not open attachments or links from unknown senders. Lazarus's attack vector is a phishing email posing as a job offer. Without that initial foothold, CVE-2026-68820 cannot be exploited remotely. Even convincing messages from «recruiters» via LinkedIn or Telegram require verification before opening any attachment.
Enable two-factor authentication. If an attacker does steal your credentials, 2FA adds an extra barrier to using them. Setup takes minutes and significantly reduces the value of any compromised passwords.
Encrypt your traffic on untrusted networks. A VPN will not stop a rootkit already embedded in the kernel — and we will be honest about that. But before any attacker reaches your machine, your traffic on public Wi-Fi is visible to everyone on the same network. An encrypted tunnel removes that exposure. LiMP VPN is a no-logs service for iOS and Android — see the features and plans, and more security guidance in our blog.
Sources
- Check Point Research: Shattering the Dream — When a Job Offer Becomes a Zero-Day Attack, August 2026
- Habr (OTUS): From local user to SYSTEM — Microsoft patches exploited Windows zero-day, August 2026
- Bleeping Computer: Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days
- The Hacker News: Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access, August 2026