Microsoft's August Patch Tuesday fixed 400 vulnerabilities, three of them zero-days, but one had already been in active use for weeks before the patch landed. CVE-2026-68820 is a use-after-free bug in afd.sys, the Windows driver that handles WinSock networking, and it lets an attacker who already has code running on a machine push their way up to full SYSTEM privileges. Check Point Research traced the exploitation to Lazarus, the North Korea-linked group behind the long-running "Operation Dream Job" campaign, which has spent this latest wave targeting defense and aerospace firms in Europe and India with fake recruiter job offers.
The zero-day itself is not the way in — it's the payoff after someone opens a bogus job-offer attachment or "coding test" download from a recruiter who doesn't exist. Once a loader gets running, it uses CVE-2026-68820 to escalate to SYSTEM and installs FudModule, a kernel-level rootkit Lazarus has refined over several campaigns. FudModule's specialty is quietly disabling the callbacks and event-tracing components that security tools rely on, so an infected machine can keep passing antivirus scans while the intrusion continues underneath. The other two zero-days patched this month, an elevation bug in the Windows User Profile Service and a flaw in the Windows Container Isolation filter driver, were publicly disclosed but not seen exploited before the fix shipped.
What this means for your business
Get this month's Windows updates installed, especially on any machine you know is running behind on patches — a forgotten laptop or an old build server is exactly what this kind of privilege-escalation bug is waiting for. But the more useful defence here is upstream of the patch: this campaign spreads through unsolicited recruiter contact, usually aimed at developers, IT staff, and anyone else attractive to a "great opportunity" pitch. Treat a job offer that arrives with an attachment, a "take-home assignment" download, or a link to run on your machine the same way you'd treat any phishing email — verify the recruiter and company through a second channel before opening anything, and never run an unfamiliar executable "just to see the test". If someone on your team has already opened something like this, don't assume a clean antivirus scan settles it; FudModule is built specifically to look invisible to that scan, so a machine with any real suspicion attached to it is worth having properly checked rather than waved through.