Full research report

Lazarus hackers exploited Windows zero-day to target defense firms

Original reporting ↗
★ Threat intelligence assessment medium confidence

Executive assessment

The strongest evidence concerns CVE-2026-68820 itself: Microsoft and NVD identify a local AFD.sys use-after-free, while CISA confirms exploitation in the wild and prioritises remediation. Independent publications consistently relay Check Point's finding that Lazarus incorporated the flaw into FudModule during an Operation Dream Job campaign targeting defence-related organisations. CVE-2025-49113 is independently verified as an authenticated Roundcube remote-code-execution flaw with public technical details and vendor fixes, but its use to install RelayShell in this specific campaign is supported principally by the campaign reporting. Defenders should therefore treat Windows patching as urgent, remediate exposed Roundcube servers, and hunt for both endpoint privilege escalation and server-side persistence rather than treating the two CVEs as a single exploit chain.

What happened

Check Point reporting, independently summarised by multiple security publications, attributes a new Operation Dream Job wave to Lazarus and says the group exploited CVE-2026-68820 as a Windows zero-day from early July 2026. Microsoft fixed the vulnerability in its August 2026 security updates, and CISA added it to the Known Exploited Vulnerabilities catalogue on 11 August. The same campaign reporting also links compromised Roundcube servers and RelayShell to CVE-2025-49113, although the exact initial-access sequence remains less firmly established.

Affected scope

CVE-2026-68820 affects supported Windows configurations containing the Ancillary Function Driver for WinSock; campaign reporting specifically observed exploit support for Windows 11 builds 26100 and 26200. CVE-2025-49113 affects Roundcube Webmail before 1.5.10 and Roundcube 1.6.x before 1.6.11. Reported targets include defence, aerospace, aviation, surveillance-sensor, drone and robotics organisations in Europe and India, with additional activity reported in Brazil, France and Germany.

Technical assessment

CVE-2026-68820 is a use-after-free condition in AFD.sys that an already authenticated, low-privileged local user can trigger through a race condition to obtain SYSTEM privileges without further user interaction. It is a post-compromise privilege-escalation primitive rather than a remote initial-access flaw; reporting says Lazarus incorporated it into FudModule, a kernel-mode rootkit used to interfere with endpoint security controls. CVE-2025-49113 permits an authenticated Roundcube user to reach remote code execution through unsafe PHP object deserialisation, and campaign reporting associates it with deployment of the RelayShell PHP web shell.

Recommended defensive actions

  1. apply the August 2026 Microsoft security updates to affected Windows systems as the highest-priority endpoint remediation
  2. upgrade Roundcube 1.6.x to 1.6.11 or later and Roundcube 1.5.x to 1.5.10 or later
  3. hunt for unexpected kernel-driver activity, endpoint-security telemetry loss, Smart App Control changes and anomalous processes running as SYSTEM
  4. inspect internet-facing Roundcube hosts for unfamiliar PHP files, unexplained authenticated settings-upload requests and web-server child processes spawning commands
  5. reset credentials associated with exposed or compromised Roundcube installations and enforce multi-factor authentication where supported
  6. review recruitment-themed messages and attachments delivered to employees in defence, aerospace and aviation roles
  7. isolate systems showing FudModule, Troy or RelayShell indicators and preserve volatile and web-server evidence before remediation

Uncertainties and evidence gaps

  • The primary Check Point page was unavailable during verification, so detailed campaign claims such as exact victim counts, supported Windows builds and malware capabilities rely on consistent secondary reporting rather than direct inspection of the original report.
  • CISA confirms exploitation of both vulnerabilities in the wild but does not, by itself, attribute either vulnerability to Lazarus or establish that every exploitation event belongs to this campaign.
  • Reporting assesses that valid credentials were probably used before CVE-2025-49113 exploitation, but the source and timing of those credentials have not been publicly established.
  • No public proof-of-concept or exploit code for CVE-2026-68820 was identified during this investigation.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessCVE-2026-68820 requires authenticated local access or prior code execution with low privileges; CVE-2025-49113 requires an authenticated Roundcube session.
ComponentWindows Ancillary Function Driver for WinSock (AFD.sys) kernel boundary; separately, Roundcube's authenticated settings-upload handling and PHP object-deserialisation boundary.
MechanismA use-after-free race condition permits local privilege escalation on Windows; unsafe handling of authenticated input permits PHP object deserialisation and code execution in vulnerable Roundcube releases.
ImpactWindows exploitation can elevate an existing foothold to SYSTEM and facilitate security-control interference; Roundcube exploitation can produce server-side code execution and persistent web-shell access.
DetectionMonitor for unusual processes gaining SYSTEM privileges, unexpected interaction with AFD.sys, loss or suppression of endpoint telemetry, security-setting changes, anomalous authenticated Roundcube upload requests, new PHP files and web-server processes launching commands.
MitigationInstall Microsoft's August 2026 security updates for affected Windows versions; upgrade Roundcube to 1.5.10, 1.6.11 or a later supported release.
Exploitation status

Confirmed active exploitation of CVE-2026-68820 in the reported Lazarus campaign; CVE-2025-49113 is also known exploited and has a public technical write-up, but no public CVE-2026-68820 proof-of-concept was identified.

Research process

The investigation first separated the actively exploited Windows privilege-escalation vulnerability from the related Roundcube server compromises. Microsoft, NVD and CISA establish the Windows flaw's mechanism, patch availability and exploitation status, while independent reporting corroborates Check Point's Lazarus attribution. NVD, Roundcube releases and the original Roundcube researcher establish the second vulnerability's authenticated remote-code-execution mechanism and fixes, but its precise role in this campaign remains less certain.

  1. What is CVE-2026-68820 and does authoritative evidence confirm exploitation?
    Reviewed the National Vulnerability Database record.
    nvd.nist.gov ↗

    The flaw is a local use-after-free in the Windows Ancillary Function Driver for WinSock, scored 7.0, requiring low privileges and no user interaction; NVD identifies it as present in CISA's catalogue.

    why This establishes that the vulnerability is a post-access privilege escalation rather than a remote entry vector and confirms that exploitation evidence exists independently of campaign reporting.

  2. When was the Windows vulnerability added to the exploited-vulnerability catalogue and what action is required?
    Reviewed CISA's Known Exploited Vulnerabilities entry.
    cisa.gov ↗

    CISA added CVE-2026-68820 on 11 August 2026 and directs organisations to apply vendor mitigations under risk-based patching guidance.

    why CISA's inclusion supports confirmed exploitation in the wild and raises remediation priority regardless of the relatively moderate CVSS score.

  3. Does independent reporting corroborate Lazarus use of the zero-day?
    Read reporting on Microsoft's August 2026 security release.
    thehackernews.com ↗

    The report says Microsoft flagged the vulnerability as actively exploited and that Check Point attributed its use to Lazarus in Operation Dream Job.

    why This independently corroborates the campaign attribution while preserving the distinction between Microsoft's exploitation confirmation and Check Point's actor attribution.

  4. Was the vulnerability used to deploy a kernel-level capability?
    Reviewed a second independent account of the campaign and patch release.
    helpnetsecurity.com ↗

    The publication reports that North Korean attackers used the flaw to deploy a kernel-mode rootkit in a new Operation Dream Job wave.

    why A second reporting domain supports the operational significance: the flaw elevated an established foothold to kernel-level control rather than providing initial access.

  5. How does CVE-2025-49113 relate technically, and which versions are vulnerable?
    Reviewed the NVD record for the Roundcube vulnerability.
    nvd.nist.gov ↗

    Authenticated users can obtain remote code execution through PHP object deserialisation in Roundcube before 1.5.10 and 1.6.x before 1.6.11; the CVE is also in CISA's exploited-vulnerability catalogue.

    why This confirms the second CVE is technically capable of supporting the reported server compromise but requires valid authentication.

  6. Did Roundcube publish fixed releases?
    Reviewed the Roundcube 1.5.10 release record.
    github.com ↗

    Roundcube released version 1.5.10 on 1 June 2025 as a security update fixing post-authentication remote code execution via PHP object deserialisation.

    why This provides a vendor-backed minimum fixed version and a concrete remediation for the 1.5 branch.

  7. What is the fixed version for the current Roundcube 1.6 branch?
    Reviewed the Roundcube 1.6.11 release record.
    github.com ↗

    Roundcube released 1.6.11 as a security update and recommended updating all production 1.6.x installations.

    why This establishes the corresponding supported fix for 1.6 deployments.

  8. Is technical exploit information publicly available for either vulnerability?
    Reviewed the original public technical disclosure for CVE-2025-49113.
    fearsoff.org ↗

    The researcher documents the authenticated deserialisation flaw, affected releases and rapid weaponisation after patch publication; no equivalent public exploit reference for CVE-2026-68820 was identified.

    why This supports public technical availability for the Roundcube issue while avoiding the unsupported conclusion that a Windows proof-of-concept is public.

Named in this story
ActorsLazarus GroupNorth Korean threat actors
MalwareFudModuleTroyRelayShell
Targetsdefence organisationsaerospace organisationsaviation organisationsmilitary-technology companiesorganisations in Europe and Indiainternet-facing Roundcube Webmail servers
Related CVEs CVE-2026-68820CVE-2025-49113

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (3 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 56 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok11 records Primary evidence1 matched items Published the source report used to frame and date the event.
CISA KEVkev ok1665 records Primary evidence3 matched items Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. Supplied a vendor or government advisory opened and verified during focused research.
NVDcve ok900 records Primary evidence2 matched items Supplied a vendor or government advisory opened and verified during focused research.
CISA Alertsnews ok empty0 records Corroborating1 matched items A page from this source was opened and verified during focused research.
FIRST EPSSepss ok7602 records Context2 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5324 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok682 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1008 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok8 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok12 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok13 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1590 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Rapid7news ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok6 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok10 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 21 opened outside the registered collection
References & evidence
Vulnerability & exploitation4
CVE-2026-68820 CISA KEV Microsoft Windows Ancillary Function Driver for WinSock · added 2026-08-11 CISA catalog ↗
CVE-2025-49113 CISA KEV Roundcube Webmail · added 2026-02-20 CISA catalog ↗
CVE-2025-49113 EPSS 97.7% 100th percentile exploitation probability
CVE-2026-68820 EPSS 0.4% 28th percentile exploitation probability
PoC & exploit code1
Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization [CVE-2025-49113] fearsoff.org ↗

Technical disclosure describes the authenticated Roundcube vulnerability and reports rapid weaponisation after its patch became public.

Vendor & gov advisories6
Microsoft Security Update Guide: CVE-2026-68820 msrc.microsoft.com ↗

Canonical Microsoft advisory and update reference for the Windows privilege-escalation vulnerability.

CISA Known Exploited Vulnerabilities Catalog: CVE-2026-68820 cisa.gov ↗

CISA records confirmed exploitation and added the Windows vulnerability on 11 August 2026.

NVD: CVE-2026-68820 nvd.nist.gov ↗

Confirms a local use-after-free in the Windows Ancillary Function Driver for WinSock and inclusion in CISA's catalogue.

NVD: CVE-2025-49113 nvd.nist.gov ↗

Defines the authenticated Roundcube PHP object-deserialisation vulnerability and affected version ranges.

Roundcube Webmail 1.6.11 security release github.com ↗

Vendor release recommends updating all production Roundcube 1.6.x installations.

Roundcube Webmail 1.5.10 security release github.com ↗

Vendor release fixes post-authentication remote code execution in the 1.5 branch.

Analysis & research3
Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack thehackernews.com ↗

Independent reporting corroborates active exploitation, the local SYSTEM escalation, and Check Point's Lazarus attribution.

Microsoft patches 400+ vulnerabilities, one zero-day under attack helpnetsecurity.com ↗

Corroborates use of the Windows flaw by North Korean attackers to deploy a kernel-mode rootkit in Operation Dream Job.

Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization fearsoff.org ↗

Original vulnerability research establishes the Roundcube mechanism, authentication prerequisite and fixed versions.