Lazarus hackers pair fake job offers with Windows zero-day exploit
The North Korea-linked Lazarus group is using fake job offers, trojanized PDF software and a Windows zero-day in attacks aimed primarily at the defense sector, Check Point researchers have found.
The activity is part of Operation Dream Job, a long-running campaign in which attackers pose as recruiters and lure targets with job opportunities at well-known companies. One of the decoy documents uncovered during the investigation used a Lockheed Martin job description.
Check Point was unable to determine how victims were first approached. Based on earlier Dream Job operations, they assess that Lazarus likely contacted targets through professional networking platforms such as LinkedIn or through messaging applications.
“Posing as recruiters, the attackers present enticing job opportunities and ultimately direct victims to download malicious files,” the researchers noted.
Lazarus exploits Windows zero-day to gain SYSTEM privileges
Researchers identified two infection chains running in parallel. In the first, the victim is convinced to download an encrypted ZIP archive containing three files:
- A legitimate, digitally signed PDF viewer executable
- A malicious DLL loaded through DLL sideloading
- An encrypted payload with a PDF extension
High-level overview of the DLL sideloading infection chain (Source: Check Point)
“When the victim launches the executable, the malicious DLL libmupdf.dll is loaded via DLL sideloading. The DLL extracts a decoy PDF document from the encrypted payload and displays it to the user, while simultaneously extracting, decrypting, and executing an embedded payload directly in memory,” the researchers explained.
The malware then runs MISTPEN, an in-memory downloader that profiles the compromised system and retrieves additional components.
One of those components exploits CVE-2026-68820, a local privilege escalation vulnerability in the Windows AFD.sys driver. Successful exploitation gives the attackers SYSTEM privileges and lets them deploy FudModule, a Lazarus kernel-mode rootkit built to interfere with security monitoring.
Researchers tested the exploit against an updated Windows 11 system and determined that it targeted a previously unknown vulnerability that had been exploited in Operation Dream Job since at least early July.
Check Point reported the vulnerability to Microsoft, which patched it on August 11, 2026, as part of its Patch Tuesday updates.
Trojanized PDF viewer delivers new backdoor
A second infection chain, detected in July, shares characteristics with Operation Dream Job activity documented by ESET in 2025.
In this chain, the attackers sent fraudulent job offers impersonating privacy technology company Enveil and instructed targets to download SecurityPDF, a modified version of an open-source PDF viewer.
When an attacker-prepared PDF is opened with SecurityPDF, the application extracts and executes an embedded payload. The payload installs Troy, a newly documented backdoor that gives the attackers remote access to the compromised system.
The attackers created at least three websites impersonating Enveil to distribute SecurityPDF. Some ranked high in search results, including as the top result for relevant searches, according to Check Point, who found no indication that Enveil itself was targeted or compromised.
“Although we did not directly observe how the threat actor incorporated these websites into the phishing campaign, we assess that they were likely used to separate the delivery of the trojanized PDF viewer from the delivery of the crafted PDF document,” they added.
“In this scenario, victims would first receive the malicious PDF file through a phishing message and later be instructed to download the PDF viewer from what appears to be the vendor’s legitimate website.”
Compromised servers used for attacker traffic
Lazarus also compromised Roundcube webmail and other web servers and used them to relay command-and-control traffic.
Researchers found that several compromised Roundcube servers were running versions vulnerable to CVE-2025-49113. They assess that stolen credentials may have been used to authenticate to the servers before exploiting the vulnerability and deploying RelayShell, a previously undocumented PHP web shell.
Operation Dream Job expands worldwide
The campaign focused primarily on organizations in Western Europe and India, with activity extending to South America.
In at least one case, the attackers compromised an organization headquartered in France and used it to send spear-phishing messages to additional targets.
“The latest Operation Dream Job campaign demonstrates that Lazarus continues to evolve both its malware capabilities and operational tradecraft,” Check Point concluded.
Sandworm hackers target IT professionals
Another state-sponsored threat actor is also after job seekers. Ukraine’s CERT-UA has separately documented a similar tactic used by UAC-0145, a subcluster of the Russian state-linked Sandworm group, also tracked as APT44 and Seashell Blizzard. In that campaign, active since at least May 2026, attackers target system administrators and IT professionals through fake job offers.