It typically begins the same way it has for years, with an approach from a recruiter offering a role at a company the target would recognize, accompanied by a PDF describing the position in convincing detail. That approach remains one of the most effective entry points used by state sponsored threat actors today, and Check Point Research has spent recent months tracking a new wave of it. Operation Dream Job, the long running campaign attributed to the North Korea affiliated Lazarus group, has resurfaced with a previously undisclosed Windows vulnerability (CVE-2026-68820), a newly identified backdoor, and a command and control architecture built almost entirely on infrastructure the group does not own.
Key Takeaways
- Check Point Research uncovered a new wave of a long running, state sponsored campaign that uses fake job offers to target the defense sector, with particular focus on aerospace and aviation organizations in Europe and India.
- The attackers used a previously unknown vulnerability in Windows (CVE-2026-68820) to gain full control of infected computers and evade EDR visibility. Check Point reported the issue to Microsoft, which released a fix before this research was published.
- Victims are lured through fake recruiter messages and tricked into opening a malicious PDF or installing a trojanized PDF viewer, which quietly installs a newly identified backdoor that gives attackers remote access to the machine.
- Rather than running their own servers, the attackers are hijacking legitimate but compromised websites and webmail servers to relay commands, making the malicious traffic harder to distinguish from normal activity.
- In at least one case, a real organization that had already been compromised was used to send further phishing messages to new victims, borrowing its reputation to make the campaign more convincing.
What is Operation Dream Job and why does it remain effective?
Since early 2026, Check Point Research has tracked a campaign built on a straightforward premise, that professionals in the defense and aerospace sectors will engage with a compelling career opportunity. Posing as recruiters, the threat actor makes contact through platforms such as LinkedIn or direct messaging applications, presents a role at a well known company, and directs the target toward a malicious download. The technique is simple, and it continues to succeed because it targets professional ambition via sophisticated social engineering.
How does the attack unfold?
Check Point Research identified two infection chains operating in parallel.
The first relies on DLL sideloading. Victims are directed to download an encrypted archive containing a legitimate, digitally signed PDF viewer, a malicious DLL, and an encrypted payload disguised as a PDF file. When the executable is launched, the malicious DLL displays a decoy job description to the victim while decrypting and executing MISTPEN in memory, a lightweight downloader first documented by Mandiant in 2024 that communicates with attacker infrastructure through the Microsoft Graph API and OneDrive. Once reconnaissance and persistence modules have run their course and the AFD.sys exploit has succeeded, MISTPEN deploys ForestTiger, a well documented Lazarus backdoor that provides the attackers with long term remote access to the host.
The second chain is more recent and shares several characteristics with a campaign described by ESET against the UAV sector in 2025. Victims are instructed to download SecurityPDF, a trojanized PDF viewer, from one of several websites impersonating Enveil, a legitimate privacy technology company with no actual connection to the attack. Once installed, the modified viewer inspects any PDF opened through it for a hidden marker. When the marker is present, the application decrypts and launches an embedded payload that loads the Troy backdoor directly into memory.
What is the zero day, and why does it matter?
Once installed, the malware quietly gathers information about the infected computer before deploying its most serious capability, an exploit that takes advantage of a flaw in a core Windows component responsible for network connections. At first, the flaw resembled CVE-2025-60719, an unrelated vulnerability in the same component that Microsoft had already fixed in November 2025, but testing against a fully updated Windows 11 system confirmed this was something new. In practical terms, the flaw allows an attacker who has already gotten malware onto a machine to escalate from limited access to complete control of it, the kind of control normally reserved for the operating system itself.
That level of access is then used to run a highly capable rootkit, a tool designed to hide the attacker’s presence from security software and disable the logging systems that would otherwise reveal what’s happening on the machine. This version, which Check Point Research designates v3.1, builds on a tool previously reported by Gen Digital in 2024, and adds a new capability that lets it tamper with a Windows feature designed to verify that running software is trustworthy.
Check Point Research reported the vulnerability to Microsoft on July 28, 2026. Microsoft confirmed the issue three days later, assigned it CVE-2026-68820 on August 5, and released a fix on August 11 as part of Patch Tuesday.
What does the Troy backdoor do?
Troy is a previously undocumented, single DLL implant with a notably broad capability set for its size. It supports seventeen operator commands spanning file enumeration, upload and download, archive and exfiltration operations, interactive shell access, process termination, in memory DLL injection, and configuration updates, delivered through a consistent tasking and response framework. Its name derives from a PDB path embedded in the compiled binary, a path Check Point Research has observed in earlier Lazarus samples, including one referenced in an ESET report published last year.
Why is command and control running through compromised websites?
Rather than operating dedicated servers, Lazarus is increasingly relying on compromised Roundcube webmail installations and content management system platforms, many vulnerable to CVE-2025-49113, together with credentials obtained from dark web leaks. These servers are infected with RelayShell, a previously undocumented PHP webshell that functions less like a conventional backdoor and more as a communication relay between infected endpoints and the operator, exchanging commands and responses through simple text files. Check Point Research identified at least seventeen unique server identifiers associated with this relay network, and observed the operators connecting through commercial VPN services to further obscure their location.
Who is being targeted, and what should organizations do?
The current campaign concentrates on defense, aerospace, and aviation organizations, with confirmed activity in Europe, Asia and South America including France, Germany, Brazil, and India. Given the combination of a zero day vulnerability that now have a patch, a new modular backdoor, and web based infrastructure designed to resemble legitimate traffic, security teams in these sectors should prioritize the August Patch Tuesday update, review the indicators of compromise published in Check Point Research publication, and apply the same level of scrutiny to unsolicited recruiting outreach that they would apply to any unverified download request.
How can organizations defend against this kind of attack?
Nearly every stage of this campaign plays demonstrates why endpoint security needs multiple layers of prevention. The initial compromise relies on convincing users to download and execute malicious content, while later stages use in-memory malware, privilege escalation, and rootkit techniques designed to evade security controls.
Check Point Endpoint Security provides multiple opportunities to disrupt this attack chain. Threat Emulation and Threat Extraction can inspect suspicious files and archives associated with the initial delivery stage, while behavioral protections can help identify malicious activity after execution, including techniques that operate primarily in memory. Organizations should combine these prevention capabilities with rapid patching and threat hunting using the indicators of compromise identified by Check Point Research.
For CVE-2026-68820 specifically, organizations should prioritize Microsoft’s August security update. Check Point Research discovered and reported the vulnerability to Microsoft, enabling a fix before publication.
There is a second, easily overlooked angle to this campaign worth addressing directly, the risk of becoming the compromised infrastructure rather than the intended target. The Roundcube and CMS servers used to run RelayShell were not breached with anything exotic, just credentials already leaked on the dark web, paired with a known, unpatched vulnerability sitting on a public-facing server.
Check Point Exposure Management flags and fixes both of these. It’s dark web monitoring surfaces an organization’s leaked credentials, and it’s attack surface visibility shows which internet-facing systems, like a Roundcube server, are exposed and overdue for a patch, or a virtual patch until one is released. Then these risks are safely and quickly remediated. For any organization running public-facing webmail or CMS infrastructure, seeing both at once is key to avoiding becoming a relay node in a campaign like this one.