Lazarus Used a Post-Quantum Handshake to Deploy ForestTiger via afd.sys Zero-Day CVE-2026-68820

North Korea's Lazarus Group wrapped its exploit delivery in post-quantum cryptography — the same class of key exchange defenders are only starting to deploy themselves — to protect a Windows zero-day it was already using in the wild. That is the standout finding from Check Point Research, which on August 11 attributed the actively exploited afd.sys flaw CVE-2026-68820 to Lazarus and tied it to the newest wave of Operation Dream Job, the DPRK's long-running fake-recruiter espionage campaign against defense and aerospace firms.

The campaign struck organizations working on surveillance sensors, drones, and robotics across France, Germany, Brazil, and India, according to Check Point. Microsoft patched the bug in its August 2026 Patch Tuesday release, and CISA added it to the Known Exploited Vulnerabilities catalog the same day, giving federal agencies until August 25 — two weeks — to apply the fix. Per The Record, there is no workaround and the update requires a reboot.

The attribution is Check Point's, not Microsoft's: the vendor's advisory confirms active exploitation but names no actor, and no victim organizations have been publicly identified. What's firm is the tradecraft, which matches Lazarus's established playbook — a social-engineering foothold through a bogus job offer, a kernel privilege-escalation flaw to reach SYSTEM, and a rootkit to blind security tools. Reporting from The Hacker News, SecurityWeek, Help Net Security, and Infosecurity Magazine lines up on those points.

What the Post-Quantum Handshake Actually Did

The post-quantum step protected the exploit in transit — it did not encrypt the malware sitting on disk. According to Check Point's writeup, a dedicated local privilege-escalation loader fingerprinted the host, requested four public keys from the command server, and generated fresh key material with ML-KEM, the Kyber-based key encapsulation scheme NIST standardized in 2024 to resist future quantum attacks. The negotiated key decrypted the CVE-2026-68820 exploit, which ran in memory. Infosecurity Magazine reported a second encryption layer, GOST-CBC, riding on top of MISTPEN's own AES transport — a belt-and-suspenders channel around the crown-jewel payload.

Why bother? A post-quantum handshake here isn't about breaking anything today. It denies defenders and researchers the ability to recover the exploit from captured traffic — now, or years from now once quantum decryption becomes practical. It's "harvest now, decrypt later" run in reverse, with the attacker doing the hardening. This is, as far as public reporting goes, believed to be among the first observed uses of post-quantum cryptography in nation-state malware delivery. That "first" is a claim worth watching rather than a settled record, but the intent is clear enough: Lazarus is treating its zero-day like an asset it expects to keep using.

Two Lures, One Zero-Day

Lazarus ran two parallel infection chains, and both opened with a fake job. In the first, a target was talked into opening an encrypted archive that side-loaded a malicious DLL (libmupdf.dll), displayed a decoy job description — Check Point observed a Lockheed Martin listing among the lures — and quietly pulled down MISTPEN, an in-memory downloader that talks to attacker-controlled OneDrive folders through the Microsoft Graph API. MISTPEN loaded reconnaissance and screenshot modules, then the loader that fetched and ran the afd.sys exploit alongside an updated FudModule rootkit that Check Point tracks as v3.1. ForestTiger, the backdoor that grants long-term remote access, arrived at the end of that chain.

The second chain leaned on a trojanized PDF viewer called SecurityPDF, distributed from at least three sites impersonating the privacy-tech vendor Enveil (domains including envell[.]xyz, enveil[.]online, and uxtramine[.]org) — some of which ranked at the top of search results. When a booby-trapped document was opened in that viewer, it decrypted and loaded a separate backdoor, Troy, straight into memory. Neither Lockheed Martin nor Enveil was complicit; both were brands Lazarus borrowed to look legitimate, and Check Point stressed that Enveil was neither targeted nor compromised.

"What makes this campaign so dangerous is not only the zero-day vulnerability — but also how Lazarus wove legitimate, trusted infrastructure into every stage of the attack," said Sergey Shykevich, Check Point's director of threat intelligence. "They hid in plain sight, behind top-ranked search results, real vendor branding, and the reputation of organizations they had already compromised." The group ran command-and-control almost entirely on machines it didn't own — hijacked WordPress and SharePoint sites, and Roundcube webmail servers vulnerable to CVE-2025-49113 — seeding them with a previously undocumented PHP web shell Check Point calls RelayShell. In at least one case, an already-breached France-based organization was used to send phishing messages to fresh victims, borrowing its reputation to slip past filters.

Why a 7.0 Deserves the Top Slot

CVE-2026-68820 is a use-after-free in afd.sys, the Ancillary Function Driver for WinSock and the kernel-mode plumbing behind Windows Sockets. Its CVSS score is 7.0 — a middling number that undersells it. The flaw is not an entry point; an attacker needs code running on the box first. What it provides is the second step, turning a limited user session into SYSTEM, which is exactly what lets transient access become a kernel-level foothold. It was the only vulnerability in Microsoft's 400-plus-CVE August release flagged as exploited in the wild, which is why it — not the headline count — should set your patch order.

The driver has a history as a privilege-escalation target. Automox CTO Jason Kikta noted to The Record that the same component was abused by Lazarus back in 2024, and Nightwing's Nick Carroll likened the bug to an intruder slipping through a closing door to print their own all-access badge for a secure facility. Once SYSTEM is reached, FudModule 3.1 goes to work: Check Point says it disables telemetry callbacks, removes minifilters, kills the NT Kernel Logger, blinds dozens of Event Tracing for Windows providers, and — new in this build — tampers with Smart App Control by resetting its policy state to force a code-integrity reload. The point of all of it is to make the host lie to your security tooling.

What Defenders Should Do

Patch CVE-2026-68820 now — the CISA clock runs out August 25, and it applies to every Windows endpoint you manage. Beyond the patch, this campaign hands defense-industrial-base and aerospace teams a concrete hunt list. Pull Check Point's published indicators for ForestTiger and Troy and sweep for them. Scrutinize any PDF viewer installed from outside official channels, especially anything branded SecurityPDF or fetched from an Enveil lookalike. Watch for MISTPEN's tell — command-and-control routed through OneDrive and the Microsoft Graph API from hosts that have no business using them. And because the rootkit's job is to suppress telemetry, treat sudden gaps in ETW coverage or a reset Smart App Control policy as signals in their own right.

The harder problem is that the front door looked legitimate at every step. Operation Dream Job is one node in a wider DPRK effort that also runs through fake job interviews and salaried IT-worker infiltration. Shykevich's guidance is the practical version: assume trust itself can be counterfeited, verify software through official channels rather than search rankings, and extend zero-trust thinking to the legitimate-looking sites and partners you deal with daily.

My read: the post-quantum handshake will get the headlines, and it's genuinely notable — but it changes little about your week. It's an intelligence tell, not a new threat to your endpoints: it signals a well-resourced adversary investing in long-term operational security for its exploits, and it hints that "harvest now, decrypt later" thinking has crossed over to the offense. The thing that actually threatens a contractor this week is old-fashioned and unchanged — a convincing recruiter, a document, and a kernel bug that turns one click into SYSTEM. Patch the afd.sys flaw, hunt the backdoors, and treat "the download ranked first in Google" as a red flag rather than a reassurance. The cryptography is the story; the job offer is the risk.

Primary Documents

• Check Point Research — "Shattering the Dream: When a Job Offer Becomes a Zero-Day Attack"
• Microsoft Security Response Center — CVE-2026-68820 advisory (afd.sys)
• CISA — alert adding CVE-2026-68820 to the Known Exploited Vulnerabilities catalog
• The Record — CISA sets an August 25 federal deadline
• Infosecurity Magazine — detail on the ML-KEM post-quantum key exchange