DOSAR/ 26
PUBLIC DOSSIER · CYBERESPIONAGE · 13 AUGUST 2026Status: current as of this date

An authentic signal does not tell you who controls the message that carries it.

Everything looked legitimate

In a new Operation Dream Job wave, attackers linked an employer name, signed software, OneDrive, a Windows zero-day and compromised resources in one route. Each element looked familiar. Together, they moved the victim from a recruitment conversation to infrastructure for the next attack.

Choose a signal. See what was genuine and how it was used.

"Real" describes a thing. "Safe" describes its relationship with the rest of the chain.
CVE 2026-68820 Windows zero-day, patched 11 August
17 identifiers linked to likely compromised servers
FR · DE examples successful targeting reported by Check Point
11 Aug. 2026 Microsoft patch and CISA KEV listing
Choose a signal. See what was genuine and how it was used.REAL ≠ SAFE

Evidence status

Exploitation CONFIRMED

Microsoft patched it and CISA listed it as actively exploited.

DPRK attribution ASSESSMENT

The attribution belongs to Check Point's analysis.

French victim OBSERVED

The organisation is not named publicly.

Exfiltrated information UNKNOWN

The research does not say what information was exfiltrated.

The new signal

Trust became reusable

Fake job offers linked to Lazarus have appeared before. In this wave, recruitment connected to genuine software, search results, OneDrive, a kernel zero-day, compromised web servers and an organisation used for later messages.

Check Point reports successful targeting in Western Europe, including France and Germany; the campaign also targeted other regions. A familiar domain, a valid signature or a mainstream cloud service describe the object itself. A defender must also check who introduced it into the message and how it connects to the rest of the route.

"Real" describes a thing. "Safe" describes its relationship with the rest of the chain.

01 · What happened

The offer became access, then infrastructure

Check Point describes the campaign in four moments. The sequence below follows that reconstruction; the source does not publish a complete list of victims or their impact.

01IMPERSONATED

The lure looked professional

A recruiter and a familiar employer name opened the conversation.

Check Point
02REAL

The program looked legitimate

A signed PDF viewer and OneDrive made the installation and traffic look ordinary.

Check Point
03MALICIOUS

The zero-day raised privileges

CVE-2026-68820 in Windows AFD.sys enabled privilege escalation to SYSTEM.

CISA
04COMPROMISED

The compromised organisation was reused

Compromised web servers carried the traffic, and the organisation in France was used as the sender for later messages.

Check Point

02 · The signals

Real signals made the malicious message plausible

Each row shows a signal used in the campaign. Open it to see what it confirms and what it leaves unverified.

Signals from the campaign
Status
01 IMPERSONATED

Employer name

A realistic listing used the Lockheed Martin name.
How it was used

The name was familiar. The published research does not indicate company involvement in the campaign. Open source: Check Point Research

02 IMPERSONATED

Offer and recruiter

The message presented a plausible professional opportunity.
How it was used

An attacker can use a company name and a recruiter profile in a conversation about work or technology. Open source: Check Point Research

03 REAL

Digitally signed PDF viewer

A signed program made the installation look ordinary.
How it was used

The signature confirms where the file came from. It says nothing about why the sender placed it in the chain. Open source: Check Point Research

04 IMPERSONATED

Search result

Pages impersonating Enveil appeared near the top of relevant results.
How it was used

A high search ranking made the pages look more credible. Open source: Check Point Research

05 REAL

Microsoft OneDrive

OneDrive appeared in the malware's communications.
How it was used

A real service can carry malicious traffic. Open source: Check Point Research

06 REAL

Windows AFD.sys

CVE-2026-68820 opened the route to SYSTEM privileges.
How it was used

Microsoft patched the vulnerability on 11 August 2026. CISA listed it as actively exploited. Open source: CISA · Known Exploited Vulnerabilities

07 COMPROMISED

European organisation

An organisation headquartered in France was later used as a sender.
How it was used

The organisation is not named publicly. Attackers used its reputation to make later messages look credible. Open source: Check Point Research

08 COMPROMISED

Ordinary web server

Roundcube and CMS servers were used as relays.
How it was used

Check Point identified at least 17 identifiers associated with likely compromised servers. Open source: Check Point Research

09 MALICIOUS

Troy, FudModule, RelayShell

The components gave access, hid activity and relayed traffic.
How it was used

The investigation describes Troy, FudModule v3.1 and RelayShell as parts of the attack. Open source: Check Point Research

REAL

genuine in itself, while still usable in a malicious chain

IMPERSONATED

an identity, page or context imitates a familiar signal

COMPROMISED

a legitimate resource was taken over and used by someone else

MALICIOUS

the component or action is part of the attack

03 · Privilege escalation

From job offer to SYSTEM privileges

The timeline connects the recruitment message to the vulnerability that enabled SYSTEM access and the patch that followed.

CISA lists CVE-2026-68820 as actively exploited, and Microsoft published the patch on 11 August. The Lazarus / DPRK attribution comes from Check Point's analysis.

Check Point reports the vulnerability

Researchers send it to Microsoft.

CHECKPOINT

Microsoft confirms the vulnerability

Microsoft begins coordinated remediation.

MICROSOFT

CVE-2026-68820 is assigned

The vulnerability receives its public identifier.

MICROSOFT

Patch and KEV listing

Microsoft publishes the fix and CISA adds it to Known Exploited Vulnerabilities.

CISA

Independent reporting

The Record treats confirmed exploitation and Check Point's attribution separately.

RECORD

04 · Victim reuse

The organisation's servers and reputation were reused

Check Point describes two ways the victim was reused. Compromised web servers carried implant communications, while the organisation in France was used as the sender for spear-phishing. Choose one branch.

Choose what to follow

Traffic passes through a compromised legitimate server and looks like ordinary HTTPS traffic.

COMPROMISED

Organisation headquartered in France

compromised and reused

infrastructure
COMPROMISED

Compromised web server

Roundcube / CMS + RelayShell

MALICIOUS

Implant communications

use a compromised server as a relay

reputation
IMPERSONATED

Organisation used as sender

the message appears to come from it

MALICIOUS

Target organisations

spear-phishing messages to other organisations worldwide

Read the reconstruction · Check Point Research

05 · What we know

Confirmed facts, assessment and unknowns

This section separates documented facts, Check Point's attribution, the inference about technical continuity and information the research does not publish.

ACTOR ASSESSMENT

Check Point attributes this wave to Lazarus / DPRK actors. Microsoft and CISA document the vulnerability and exploitation; the attribution comes from Check Point's analysis.

Open source: Check Point Research
INFERENCE

FudModule previously used a vulnerability in the same AFD.sys driver. That may indicate sustained attention to the same attack surface. This is an editorial inference; the source does not say who discovered each bug.

Open source: Check Point Research
UNKNOWN

The research does not say what defence information was exfiltrated from each victim, who used it or whether the operation changed any weapons programme.

Open source: Check Point Research

The Romanian question

The same technology categories exist in Romania

The public material does not disclose a Romanian victim. Check Point's analysis names defence, drones, surveillance sensors, robotics and aerospace among the sectors involved. Romanian suppliers in those sectors are a question for separate checking; the page does not report a compromise.

See the target categories in Check Point's analysis
INFERENCE · NO ROMANIAN VICTIM NAMED

What to check next time

Check who controls the message

When a message looks legitimate, ask:

  1. Who controls the channel through which the request arrived?
  2. What did you verify independently: the sender, the channel or the request?
  3. What changes if the sender itself has been compromised?

In this campaign, the compromised organisation was used for the traffic and messages that followed.

Sources and limits

The sources separate exploitation from attribution

Check Point describes the campaign and the infrastructure it used. Microsoft published the patch, and CISA confirmed the actively exploited listing. The Record treats the exploitation record separately from Check Point's attribution.

01PRIMARY SOURCE

Check Point Research

Reconstruction of the campaign, its malware, relay servers and later use of the French organisation.

Open source
02INDEPENDENT CONFIRMATION

CISA · Known Exploited Vulnerabilities

CVE-2026-68820 listed as actively exploited.

Open source
03OFFICIAL RECORD

Microsoft Security Update Guide

The official vulnerability record and Microsoft patch.

Open source
04SECONDARY REPORTING

The Record from Recorded Future News

Separates the patch and exploitation record from Check Point's DPRK attribution.

Open source

Valid as of 13 August 2026

Re-review if primary sources change the description of exploitation, the CVE-2026-68820 status, the attribution or the public information about victim impact.