08/13/2026
Check Point disclosed this week that Lazarus Group is using fake job offers to deploy a Windows zero-day. Recruiters impersonating Lockheed Martin and privacy-tech firm Enveil contacted targets in the defense, aerospace and robotics sectors across France, Germany, Brazil and India, then sent a trojanized PDF viewer. Opening a file through it installed a new backdoor Check Point calls Troy.
The interesting part for defenders is what happens after that initial foothold. Troy doesn't stop at low-privilege access. It chains into CVE-2026-68820, a use-after-free in afd.sys (the Windows Ancillary Function Driver for WinSock) that Microsoft patched in this month's Patch Tuesday release. A local attacker who wins a race condition against that driver goes from limited access to SYSTEM, the same level of control the operating system itself normally reserves. From there, Lazarus deployed FudModule, its kernel-mode rootkit, to blind EDR tooling on the host.
CVSS 7.0, "Important" rather than "Critical" by Microsoft's own rating. CISA added it to the Known Exploited Vulnerabilities catalog anyway and gave federal agencies until August 25 to patch, because a CVSS score measures the flaw in isolation, not what it does chained to a working delivery mechanism.
That's the pattern worth sitting with. This wasn't a novel exploit chain built for espionage-grade sophistication. It was a phishing lure convincing enough that Check Point's researchers noted the website, download and recruiter all read as authentic, followed by a privilege-escalation bug in a widely deployed driver that had already produced multiple 2026 patches. Neither half required nation-state tooling on its own. Together they got a rootkit onto defense-sector endpoints.
For organizations without a dedicated threat intel function, two things matter more than the CVE number:
First, HR and recruiting workflows are an attack surface, not just a people-process. Anyone whose job involves opening unsolicited PDFs from external contacts, recruiters, vendors, applicants, needs endpoint controls that don't depend on the human catching the lure every time.
Second, patch by exploitation status, not CVSS score alone. This was one of 421 CVEs Microsoft shipped this Patch Tuesday. It's also the only one confirmed exploited, which makes it the priority regardless of its 7.0 rating. A restart is required and there's no workaround, so it belongs on this week's list, not the next maintenance window.
Organizations running vulnerability management without exploitation-status prioritization end up patching alphabetically by severity while the one bug actually in use sits unaddressed. Endpoint detection tuned for privilege-escalation patterns, not just malware signatures, is what catches campaigns like this before the rootkit stage.
