Lazarus Group reportedly exploited the Windows `afd.sys` privilege-escalation flaw CVE-2026-68820 as a zero-day during an Operation Dream Job campaign targeting defense and aerospace organizations in four countries. Fake Enveil recruitment material delivered MISTPEN or Troy, after which the exploit elevated execution to SYSTEM and enabled installation of FudModule 3.1. The rootkit disabled Smart App Control and removed kernel callbacks used by EDR products, while ForestTiger provided persistent command access. Microsoft patched the flaw on August 11, 2026, and defenders were advised to block three campaign domains and hunt for abnormal DLL side-loading and Microsoft Graph API traffic.