CVE-2026-68820: Microsoft Windows AFD.sys Zero-Day Exploited by Lazarus

North Korea's state-sponsored Lazarus Group weaponized a previously unknown Windows kernel zero-day for at least five weeks against aerospace, defense, and aviation targets before Microsoft released a patch in August's Patch Tuesday.

What's Affected

The flaw resides in afd.sys (Ancillary Function Driver for WinSock), the core kernel-mode driver providing the socket interface for Windows networking across all modern supported versions of Windows 10, Windows 11, and Windows Server.

While Microsoft's initial rating assigned a CVSS score of 7.0 (local privilege escalation), the real-world operational impact is critical because it served as the anchor for kernel privilege escalation and security-tool blinding.

The Vulnerability

CVE-2026-68820 is a Use-After-Free (UAF) flaw in afd.sys. By sending crafted I/O control (IOCTL) requests with race conditions to socket handles, a local unprivileged process can trigger an invalid object reference in kernel memory, corrupting kernel structures to achieve arbitrary kernel read/write primitives.

Attack Chain Breakdown: Operation Dream Job

Check Point Research tracked Lazarus incorporating this exploit into their multi-stage attack chain:

1. Initial Social Engineering: Attackers target aerospace and defense engineers via LinkedIn and email disguised as job recruiters ("Operation Dream Job").
2. Malicious LNK / PDF Dropper: Victims execute weaponized payloads delivering initial userland implants.
3. Kernel Elevation via afd.sys: The malware invokes CVE-2026-68820 to elevate execution privileges directly from standard user to NT AUTHORITYSYSTEM.
4. FudModule EDR Blinding: Once inside kernel space, Lazarus deploys the FudModule rootkit, using Direct Kernel Object Modification (DKOM) to disable EDR/AV sensors (e.g., stripping callbacks and hooks) without crashing the OS.

Indicators to Check For (IOCs)

Remediation