The August zero-day was North Korea. The part still working is the job advert

The bug that would have sorted low

On 12 August this site published that Microsoft's August release contained one confirmed exploited vulnerability, that it was rated Important rather than Critical, and that a queue sorted by severity would place it below sixty-two Critical entries nobody was touching.

Check Point Research published the other half of that on 11 August. CVE-2026-68820 is a Lazarus zero-day, used against defence and aerospace companies since at least early July, to load a kernel rootkit that switches off endpoint detection.

The severity rating was correct. It describes a local privilege escalation requiring code already running on the machine. What it does not describe, and cannot, is that a state-sponsored group had been using it for five weeks to blind EDR on defence contractors.

Thirty-five days between first use and a patch

1. 7 Jul 2026

   Sample compiled

   Compiler timestamp on Afd4Eop12_x64.dll, 22:07:44 UTC.

2. Early Jul

   In the wild

   Check Point assesses active use in Operation Dream Job from this point.

3. 28 Jul

   Reported to Microsoft

   Check Point Research discloses to MSRC.

4. 5 Aug

   CVE assigned

   CVE-2026-68820.

5. 11 Aug

   Patched

   Shipped in the August Patch Tuesday release.

The interesting part is not the exploit

Every outlet will lead on the zero-day. It is the least actionable thing in the report, because it was unpatchable until Tuesday and is patched now.

What deserves attention is how people were reached, because that part is still working and nothing Microsoft shipped touches it.

The lure is a job. Recruiters approach staff at defence, aerospace and aviation companies, most likely on LinkedIn, offering roles at names people want to work for. One decoy document impersonates a Lockheed Martin job description. Another wave impersonates Enveil, a privacy technology company that Check Point is explicit was neither targeted nor compromised.

Then comes the step that should worry anybody running an estate.

The attackers built at least three websites impersonating Enveil and got them ranking in search results, in some cases as the top result for the product name. Not a link in an email. Not a lookalike domain buried in a phishing header. A site a person finds by searching for a tool they were told to install, that appears above the real vendor.

Check Point's assessment of why is the detail that matters: splitting delivery in two. The crafted PDF arrives by message; the viewer that opens it is fetched separately, from what looks like the vendor's own site. Neither half is obviously malicious on its own, and the download does not come from the phishing channel at all.

Where a control actually exists

That is the machinery. The question a defender actually has is a different one, so here is the same chain arranged by where a control exists.

Every control you own sits before the exploit

Check Point Research · 11 Aug 2026

1. 01

   Recruiter approach

   A job at a defence or aerospace name

   Stoppable: Awareness, and a route to verify a recruiter

2. 02

   Fake vendor site

   Ranking top for the tool's own name

   Stoppable: Software comes from a catalogue, not a search result

3. 03

   Encrypted ZIP opened

   Signed viewer, sideloaded DLL, crafted PDF

   Stoppable: Application control, and no unpacking to a user profile

4. 04

   MISTPEN in memory

   Beacons out over the Microsoft Graph API

   Stoppable: Egress policy, because Graph traffic looks legitimate

5. 05

   CVE-2026-68820

   Race in afd.sys, use after free, SYSTEM

   Not stoppable: Nothing. It was a zero-day until 11 August

6. 06

   FudModule v3.1

   94 ETW providers killed, callbacks unlinked

   Not stoppable: Your EDR is now being switched off by SYSTEM

Steps you control

4 of 6

All of them before

the exploit runs

Days it was a zero-day

at least 35

Four of the six steps sit before any payload executes, and each is something a normal organisation already has a lever for. The fifth was a zero-day. By the sixth the attacker holds SYSTEM and is dismantling the tooling that was meant to notice.

That is the argument in one line: for five weeks, every defence that mattered on this chain was a decision made by a person before they double-clicked anything.

The tradecraft, step by step

Enough of the chain is documented to map it properly, and the detail matters because several steps are detectable without any vendor product.

Techniques observed, and what each one leaves behind

Stage	Technique	What it looks like on a host
Delivery	T1566.002 Spearphishing link	A recruiter approach ending in a download, not an attachment
Delivery	T1608.006 SEO poisoning	A vendor download page that is not the vendor. Check the domain against the vendor’s own site, not against the search result
Execution	T1204.002 User execution	A signed PDF viewer launched from an unpacked archive in the user profile
Defence evasion	T1574.001 DLL search order hijacking	libmupdf.dll loaded from beside the executable rather than from System32
Execution	T1055.001 Reflective DLL injection	new.exe spawned in %TEMP% with a PDF viewer as parent process
Command and control	T1102.002 Web service	Outbound to graph.microsoft.com from a process with no business using it
Persistence	T1547 Boot or logon autostart	A second-stage module writing MISTPEN to disk after validation, not on first run
Privilege escalation	T1068 Exploitation for privilege escalation	CVE-2026-68820, a race in afd.sys. No host artefact until after it succeeds
Defence evasion	T1562.001 Disable or modify tools	94 ETW providers stopped, kernel callbacks unlinked, NT Kernel Logger terminated
Defence evasion	T1562.006 Indicator blocking	Smart App Control policy state set to zero and code integrity policy reloaded in place
Command and control	T1584.006 Compromise infrastructure	Beaconing to ordinary WordPress, PrestaShop and Roundcube hosts rather than to attacker domains

Three of those are worth dwelling on because they invert a normal assumption.

The staging is conditional. MISTPEN does not persist on first execution. It profiles the host first, through GetInfoPlugin for domain, hostname, user and build, then PvPlugin for the full process list with PIDs, parents and owners. Only once the operator is satisfied the target is real does a persistence module arrive. A sandbox that detonates the sample and sees nothing written to disk has not seen a benign file. It has failed the interview.

The exploit is delivered, not carried. The LPE module fetches the payload from the C2 at the moment it is needed, negotiating a session key with Kyber/ML-KEM and layering GOST-CBC over MISTPEN's own AES. A post-quantum key exchange, in a loader, to protect a single privilege escalation download. That is not necessary and it tells you what the group expects of the people collecting its traffic.

The final backdoor asks for very little. Troy supports seventeen commands, and the interesting thing is how ordinary they are: directory listing, file upload and download, ZIPDOWNLOAD which shells out to PowerShell Compress-Archive, a CMD handler that tracks cd /d so the working directory persists, and mem for in-memory DLL injection. Nothing exotic. It is a competent implant designed to look like administration.

What the rootkit does once it is too late

FudModule v3.1 is worth reading precisely because it shows what the earlier controls are protecting. Check Point's decompilation of the main routine reads as a checklist of everything a defender relies on:

LOBYTE(v6) = enable_god_mode(ctx);
  disable_crash_dump_callback(ctx);
  unlink_nonpreserved_registry_callbacks(ctx);
  unlink_targeted_minifilter_callbacks(ctx);
  disable_nt_kernel_logger(ctx);
  if ( unlink_nonpreserved_object_callbacks(ctx) == 1
    && disable_nonpreserved_ps_notify_callbacks(ctx) == 1
    && disable_kaspersky_wfp_callbacks(ctx) == 1
    && disable_hardcoded_user_etw_sources(ctx) == 1
    && hijack_handle_to_services_process(ctx) == 1
    && inject_spawn_msiexec_shellcode(ctx) == 1
    && disable_smart_app_control_remotely(ctx) == 1

Ninety-four ETW provider GUIDs are killed, matching the first ninety-four entries of the list published for the 2024 version, in the same order. Process, thread, image, object and registry callbacks are unlinked. Minifilters are removed by altitude band. The NT Kernel Logger is stopped.

Two changes from the 2024 version are worth noting. The dedicated Microsoft Defender stage is gone, leaving only an orphaned string: Defender is now blinded by the generic suppression engine like any other product, which reads as confidence rather than retreat. And a new stage tampers with Smart App Control, setting the policy state to zero and forcing an in-place reload of code integrity policy.

The version also refuses to run on anything older than Windows 11 build 26100. Lazarus is targeting current, patched, well-configured estates on purpose.

The infrastructure is other people's websites

The command and control is not attacker-owned. It is compromised Roundcube webmail servers, exploited through CVE-2025-49113, a PHP deserialisation flaw that requires valid credentials, which Check Point assesses were taken from dark web credential dumps. WordPress and PrestaShop sites were used the same way.

Each hosts RelayShell, a webshell that does not execute commands. It relays them, passing messages between the operator and the implant through session files on the compromised host. Seventeen unique identifiers were recovered, implying at least seventeen compromised servers acting as relays. Operators reached them over ExpressVPN.

One compromised organisation, headquartered in France, was then used to send spear-phishing to further targets. Its reputation became the attacker's credibility. If your suppliers or partners are in defence, that is the pattern to sit with.

Indicators

Infrastructure

Indicator	Type	Associated with
envell[.]xyz	Domain	Fake Enveil site distributing SecurityPDF
enveil[.]online	Domain	Fake Enveil site distributing SecurityPDF
uxtramine[.]org	Domain	Troy backdoor C2
135.181.67[.]203	IPv4	Troy backdoor C2
135.181.185[.]158	IPv4	Troy backdoor C2

Sample hashes, by family

Family	Count	First hash (truncated)
DLL loader and dropper	12	2b4987c07a3d9a9a
MISTPEN	9	2db25ac41a66aa52
ForestTiger	5	72dccae85e062f54
PDF payload	6	a673ae661593c0de
Troy backdoor	3	590fb6ae19480d69
SecurityPDF.exe	2	743172aab606974b
RelayShell	2	21c3ad4838c4324b
FudModule	1	3b6378df8442e63a

The marker string inside a crafted PDF is worth a detection rule of its own, because it is plain text and specific: This document is encrypted with sumatrapdf reader!!!!!!!!!!!!. The payload after it is XOR encoded with a single byte, 0x39, and written to %TEMP%\\new.exe.

What to do this week

The position

There is a version of this story that is about a clever kernel exploit, and it is the version most people will publish. It is also the version with nothing in it for a reader, because Microsoft closed it on Tuesday.

The version worth your attention is that a nation-state group's most reliable delivery mechanism is a job advert and a search result. No exploit was required to get to the point where an exploit became useful. Somebody had to be flattered, and then had to download software from a website that ranked first.

The zero-day is patched. The recruitment lure, the SEO-ranked impersonation site, and the habit of installing tools from search results are all exactly as effective today as they were last month.