North Korea hid a Windows zero-day inside fake job offers for five weeks

For at least five weeks before Microsoft shipped a fix, North Korea's Lazarus Group was breaking into defense contractors using a Windows driver bug that turned a booby-trapped job application into full SYSTEM control with kernel-level stealth — and they were getting in through fake recruiter messages that looked exactly like the real thing.

How a job application becomes a rootkit

Lazarus doesn't hack its way in first — it gets invited in. Operators impersonate recruiters on professional networking sites and messaging apps, dangling real-looking job openings at defense, aerospace and robotics companies, then send what looks like an application packet or requirements document. Check Point documented two separate delivery chains, and both end the same way: code execution, followed by CVE-2026-68820 turning ordinary user access into SYSTEM.

The clever part isn't the exploit — race conditions in afd.sys have shown up in Windows attacks before, and researchers at Tenable guessed 'nation-state' from the pattern alone before Check Point named names. The clever part is the lure. One of the delivery sites impersonating a legitimate PDF viewer ranked near the top of search results, and Check Point found Lazarus impersonating recruiters from real companies, including Lockheed Martin and Enveil, to make the offers feel legitimate enough to open.

The bug itself: CVE-2026-68820

Microsoft's own description is dry — a use-after-free flaw that lets a locally authenticated attacker 'trigger a race condition' and gain SYSTEM privileges with no user interaction required once code is running. That's a local-only bug on paper, the kind that normally waits for a separate exploit to get an attacker onto the machine first. Lazarus paired it with exactly that: the fake job offer is the delivery mechanism, and CVE-2026-68820 is what turns 'I opened a bad PDF' into 'the attacker now owns this machine at the kernel level.'

Who's actually being targeted

• Defense, aerospace and aviation contractors
• Drone and robotics manufacturers
• Military-technology and surveillance-sensor companies
• Confirmed geographic spread: the United States, France, Germany, Brazil and India's expanding defense sector
• At least one compromised organization, headquartered in France, was then used to launch further spear-phishing campaigns against other targets worldwide

It's worth noticing how familiar the underlying con is, even with a novel kernel exploit attached. A separate incident this year used entirely fabricated online identities to trick a real developer into shipping malicious code, and Framework's own breach traced back to a single unauthenticated password-reset endpoint — different bugs, same lesson: the technical exploit is rarely the weak point. Trust is.

The bigger pattern

This is the second time in a month Aliteq has covered a nation-state or serious threat actor getting a head start on a Windows-adjacent bug before a patch existed — see Microsoft's own Azure and Teams CVSS-10 scramble before its last Patch Tuesday and Cisco's pile of 9.9-rated SD-WAN bugs from the same stretch of August. None of these are isolated. What's actually notable about Lazarus's approach here isn't the exploit chain — it's the patience. Operation Dream Job has run for years, refining the same basic con because it keeps working, on smart people, at serious companies. A kernel zero-day is expensive to build. A fake job offer that a stressed engineer opens without thinking twice is free.