Lazarus Group Exploits Windows Kernel Zero-Day CVE-2026-68820 to Deploy FudModule Rootkit
The North Korean Lazarus group is actively exploiting a zero-day vulnerability in the Windows kernel to obtain SYSTEM privileges and deploy the FudModule rootkit. The flaw, identified as CVE-2026-68820, was patched by Microsoft on 11 August.
The vulnerability affects afd.sys, the driver that handles network functions and socket management in Windows. Exploitation requires the attacker to already possess the ability to execute code with limited privileges on the target machine. From that position, the bug enables escalation to SYSTEM rights, granting extensive control over the operating system.
The campaign is part of Operation Dream Job, a long-running espionage operation that relies on fabricated job offers aimed at specialists in defense, aerospace, and aviation. Activity has been observed in Brazil, Europe, and India. Targets are lured into opening tampered PDF viewers or specially crafted files.
The attack chain begins with the MISTPEN downloader, which gathers basic system information before delivering the zero-day exploit. After privilege escalation, FudModule interferes with Windows telemetry mechanisms and reduces visibility for EDR solutions. The latest variant can also manipulate Smart App Control to further weaken additional protections.
Organizations are advised to apply the August Windows security updates immediately and to strengthen monitoring of files associated with fake employment opportunities.
Related articles
North Korean Hacker Groups: Lazarus, Kimsuky, Andariel and Financial Clusters Behind Billions in Thefts
North Korean state-sponsored hacking operations linked to the Reconnaissance General Bureau and other agencies involve dozens of clusters conducting cyber espionage, technology theft, and large-scale financial crimes. Groups such as Lazarus, Kimsuky, Andariel, BlueNoroff, and APT38 have been tied to the 2014 Sony Pictures breach, the 2016 Bangladesh Bank heist, WannaCry, and recent multi-billion-dollar cryptocurrency thefts from Bybit and Binance. Specialized teams focus on fake job offers to infiltrate defense contractors, supply-chain attacks on developers, and ransomware operations that fund further espionage. Researchers from Microsoft, CrowdStrike, Google, and Mandiant track overlapping clusters using names like Diamond Sleet, Labyrinth Chollima, TraderTraitor, and UNC2970, noting frequent infrastructure sharing and evolving tactics. The activity spans political intelligence collection, defense technology theft, and crypto wallet compromises, with some clusters creating fictitious IT workers to gain remote access to foreign companies.
China-Linked WARP PANDA Exploits VMware ESX Zero-Day CVE-2026-41709 to Evade Logging
CrowdStrike reported on 28 October 2026 that the China-linked group WARP PANDA used CVE-2026-41709, a zero-day in VMware ESX, to operate without leaving records on compromised hypervisors. The vulnerability carries a low CVSS 3.1 score of 2.7 and was added the same day to the CISA Known Exploited Vulnerabilities catalog with a remediation deadline of 11 November. Broadcom describes the flaw as insufficient logging that allows a malicious administrator to execute certain operations without them appearing in logs. The issue does not enable remote code execution or privilege escalation on its own; its value lies in erasing the audit trail that incident responders rely on to reconstruct activity. CrowdStrike linked the exploitation to espionage operations against U.S. legal-sector organizations, with activity intensifying in early 2026. The report also highlights deployment of BRICKSTORM and SharpStorm malware in vCenter environments along with stolen cloud session tokens. Broadcom has released fixed builds for ESXi 9.1, 9.0.2 and 8.0 U3j, while VMware Cloud Foundation 5 requires version 5.2.4.
North Korean WaterPlum Group Infects 30,000 Computers Across 100 Countries via Fake Coding Tests
The North Korean-linked group WaterPlum, also known as Contagious Interview, has infected at least 30,000 computers in more than 100 countries between December 2025 and July 2026. According to the Internet Crime Complaint Center (IC3), the operation moved at least $10.7 million in cryptocurrency to North Korea and compromised more than 7,000 wallets. Attackers pose as recruiters on social media and freelance platforms, luring software developers with nonexistent job offers that require downloading malicious files disguised as coding tests. The malware arsenal includes BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle, with the latter hiding inside blockchain-themed projects and abusing Visual Studio Code configurations. Developers are specifically targeted because they often store production keys, wallets, and credentials on the same machines used for testing third-party code. Japanese authorities have dismantled laptop farms connected to the scheme that helped maintain the attackers' operational cover.
US Offers $10 Million Reward for Iranian IRGC Cyber Commander Amir Yaryab
The United States has announced a reward of up to $10 million through the Rewards for Justice program for information leading to the identification or location of Amir Yaryab, leader of the Cyber Operations Command within Iran's Islamic Revolutionary Guard Corps (IRGC). Yaryab oversees units responsible for cyber operations targeting critical infrastructure across the United States, Europe, and the Middle East. Groups under his direction, including Shahid Hemmat and Shahid Shushtari, have conducted campaigns against defense, energy, telecommunications, finance, transportation, hotels, and airlines sectors. He is also linked to structures associated with the CyberAv3ngers group, known for attacks on industrial control systems and operational technology equipment. Previous operations attributed to IRGC-linked actors compromised internet-exposed Unitronics programmable logic controllers, affecting at least 75 devices between November 2023 and January 2024, including 34 in the US water and wastewater sector. The reward specifically targets individuals acting under foreign government direction in malicious cyber activities against US critical infrastructure.