Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack
2026-08-11 • Checkpoint •
Lazarus expanded Operation Dream Job against defense, aerospace, and aviation organizations by combining fraudulent recruitment lures with trojanized PDF viewers and impersonation websites. The campaign exploited the Windows AFD.sys zero-day CVE-2026-68820 to run an updated FudModule rootkit with SYSTEM privileges and deployed MISTPEN, ForestTiger, and the newly documented Troy backdoor. Compromised Roundcube and CMS servers infected with the new RelayShell webshell served as command-and-control relay nodes. Microsoft patched CVE-2026-68820 on August 11, 2026, following Check Point's responsible disclosure.
Indicators of Compromise
Related Actors
Related Reports
Shares tags: DreamJob, FudModule, Lazarus • Shares 3 IOCs • Published within a week
2026-09-18 •
47% Match
#Trend
#DreamJob
#Kimsuky
#Lazarus
#FamousChollima
#JasperSleet
#PolinRider
#CVE-2026-68820
Shares tags: DreamJob, Lazarus, CVE-2026-68820
2026-09-18 •
47% Match
#Trend
#DreamJob
#Kimsuky
#Lazarus
#FamousChollima
#JasperSleet
#PolinRider
#CVE-2026-68820
Shares tags: DreamJob, Lazarus, CVE-2026-68820
2026-09-07 •
45% Match
#APT38
#Andariel
#Kimsuky
#CryptoCore
#TEMP.Hermit
#JadeSleet
#CitrineSleet
#ITWorker
#MoonstoneSleet
#Lazarus
#FamousChollima
Shares tag: Lazarus • Published within a month
2026-09-04 •
45% Match
#APT37
#Wateringhole
#Lazarus
#T1082
#T1119
#T1041
#T1560
#T1071.001
#T1059.004
#T1027
#T1057
#T1036.005
#T1132.001
#T1102
#T1497.001
#T1480
#T1543
#T1070.002
#T1548
#T1556.003
#T1190
#T1070.006
#T1106
#T1568
#T1572
#T1185
#T1562.006
#HAProxy
#curlRAT
#Ted
Shares tag: Lazarus • Published within a month
2026-08-31 •
45% Match
North Korean hackers are moving tens of millions on Hyperliquid as Trump pushes to onshore the crypto platform
Coin Desk
Shares tag: Lazarus • Published within a month