Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor

The investigation separated the exploited Windows privilege-escalation vulnerability from the social-engineering campaign and the separate Roundcube flaw used against supporting infrastructure. Microsoft, NVD and CISA establish the weakness, affected scope, patch availability and exploitation status, while three security publications consistently describe Lazarus attribution and the Operation Dream Job infection chains. The direct Check Point publication could not be accessed, reducing confidence in granular attribution, victimology and malware details from high to medium.

1. What event and claims were being reported?
   Reviewed the supplied report and followed its references to the campaign research and Microsoft vulnerability record.
   thehackernews.com ↗

   The report attributes exploitation of CVE-2026-68820 to Lazarus during Operation Dream Job and describes two social-engineering chains, FudModule privilege escalation, new Troy malware and compromised infrastructure.

   why This framed the event but remained secondary reporting requiring confirmation from vendor and government records.

2. Could the original campaign investigation be verified directly?
   Opened the linked Check Point research publication.
   blog.checkpoint.com ↗

   The site returned an HTTP 403 access-denied page, preventing direct examination of the original technical evidence.

   why This creates a material attribution and detail-verification limitation despite consistent downstream reporting.

3. Does Microsoft recognise CVE-2026-68820 and provide a fix?
   Opened Microsoft's Security Update Guide record.
   msrc.microsoft.com ↗

   Microsoft maintains a vendor security record for CVE-2026-68820 associated with the August 2026 security release.

   why This confirms the identifier and vendor remediation source rather than relying on the original article.

4. Is exploitation independently confirmed in the wild?
   Reviewed CISA's filtered Known Exploited Vulnerabilities catalogue entry.
   cisa.gov ↗

   CISA lists the AFD.sys use-after-free vulnerability as known exploited, added 11 August 2026, with remediation due 25 August 2026 for covered federal organisations.

   why This supports confirmed active exploitation, although CISA does not attribute the activity to Lazarus.

5. What are the vulnerability prerequisites, severity and affected configurations?
   Reviewed the National Vulnerability Database record for CVE-2026-68820.
   nvd.nist.gov ↗

   NVD describes a local use-after-free requiring low privileges, with high complexity, no user interaction at the exploitation stage, CVSS 7.0 and broad impact across Windows client and server releases.

   why This establishes that CVE-2026-68820 is a post-compromise elevation flaw rather than the campaign's remote entry point.

6. Is the campaign account corroborated outside the supplied article?
   Reviewed separate reporting focused on the Lazarus and FudModule activity.
   cybersecuritynews.com ↗

   The publication independently reports the same Lazarus attribution, defence and aerospace targeting, DLL side-loading and SecurityPDF chains, MISTPEN delivery and SYSTEM-level FudModule deployment.

   why The consistency strengthens the campaign assessment, although the report also relies substantially on Check Point's investigation.

7. Is exploitation and patch timing corroborated independently of campaign-focused coverage?
   Reviewed Help Net Security's August 2026 Patch Tuesday analysis.
   helpnetsecurity.com ↗

   The analysis confirms that Microsoft patched CVE-2026-68820 in August 2026, describes it as exploited in zero-day attacks and states that a locally authenticated low-privileged attacker can reach SYSTEM without user interaction at that stage.

   why This corroborates the core vulnerability facts and exploitation status from another domain.

8. How does CVE-2025-49113 relate to this story?
   Reviewed the NVD record for the Roundcube vulnerability named in infrastructure reporting.
   nvd.nist.gov ↗

   Roundcube before 1.5.10 and 1.6.x before 1.6.11 permits authenticated remote code execution through PHP object deserialisation and is listed as known exploited.

   why This confirms the technical and affected-version claims; campaign reporting links the flaw to compromised Roundcube command-and-control servers rather than Windows endpoint elevation.