# Everything looked legitimate In the new Operation Dream Job wave, a familiar name, signed software, a Microsoft service and a compromised organisation could all belong to the same malicious story. The lesson is relational: an authentic thing does not authenticate the chain that carries it. ## The central argument Fake job offers from the Lazarus ecosystem are familiar. The new feature in this reconstruction is the combination: recruitment, genuine software, search visibility, OneDrive, a kernel zero-day, compromised web servers and a victim used for the next round. For a defender, that changes the question. A familiar domain, a valid signature or a mainstream cloud service describe an object. They do not automatically verify the relationship between that object and the message that brings it into a network. > “Real” describes a thing. “Safe” describes its relationship with the rest of the chain. ## What happened Before reading the signals, here is the four-moment operational reconstruction. It follows the primary source’s described sequence; it is not a complete list of victims or impact. 1. **The lure looked professional** — A recruiter and a familiar employer name opened the conversation. ([Check Point](https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/)) 2. **The program looked legitimate** — A signed PDF viewer and OneDrive made the installation and traffic look ordinary. ([Check Point](https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/)) 3. **The zero-day raised privileges** — CVE-2026-68820 in Windows AFD.sys opened the route to SYSTEM. ([CISA](https://www.cisa.gov/news-events/alerts/2026/08/11/cisa-adds-three-known-exploited-vulnerabilities-catalog)) 4. **The victim became infrastructure** — Compromised web servers and the reputation of an organisation in France were reused for traffic and later messages. ([Check Point](https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/)) ## The trust stack Each row carries a signal that a reader or a system might recognise. Open it to see the signal’s limit. - **IMPERSONATED** · Employer name: A realistic listing used the Lockheed Martin name. The name was familiar. The published research does not indicate company involvement in the campaign. - **IMPERSONATED** · Offer and recruiter: The approach arrived as a plausible professional opportunity. Professional identity is easy to borrow when a target expects a job offer or a technical conversation. - **REAL** · Digitally signed PDF viewer: A signed program made the installation look ordinary. An authentic signature attests to a file’s origin, not to the intent of the person placing it in the chain. - **IMPERSONATED** · Search result: Pages impersonating Enveil appeared high in relevant results. Search visibility supplied a second legitimacy signal. - **REAL** · Microsoft OneDrive: OneDrive appeared in the malware’s communications. A real service can carry traffic with a malicious purpose. - **REAL** · Windows AFD.sys: CVE-2026-68820 opened the route to SYSTEM privileges. Microsoft patched the vulnerability on 11 August 2026. CISA listed it as actively exploited. - **COMPROMISED** · European organisation: An organisation headquartered in France was later used as a sender. The organisation is not named publicly. Its reputation became an operational asset for later messages. - **COMPROMISED** · Ordinary web server: Roundcube and CMS servers were used as relays. Check Point identified at least 17 identifiers corresponding to likely compromised servers. - **MALICIOUS** · Troy, FudModule, RelayShell: The components delivered access, concealment and relay. The investigation describes Troy, FudModule v3.1 and RelayShell as parts of the attack architecture. ## Vulnerability timeline - **28 July** · Check Point reports the bug. Researchers send the vulnerability to Microsoft. - **31 July** · Microsoft confirms the vulnerability. The issue enters the coordinated patch process. - **5 August** · It receives a CVE. The vulnerability becomes CVE-2026-68820. - **11 August** · Patch and KEV listing. Microsoft publishes the fix and CISA adds it to Known Exploited Vulnerabilities. - **12 August** · Independent reporting. The Record separates confirmed exploitation from Check Point’s attribution. CVE-2026-68820 is confirmed as actively exploited. The link to Lazarus for this wave remains Check Point’s assessment. ## Victim as infrastructure Check Point describes two forms of reuse. Legitimate web servers carried implant communications, while an organisation headquartered in France was later used for spear-phishing. Choose the route you want to follow. - Implant traffic: Traffic passes through a compromised legitimate server and resembles ordinary HTTPS. - Sender reputation: A sender that appears to be a real organisation increases the credibility of the next lure. ## What we know ### DOCUMENTED FACT Microsoft patched CVE-2026-68820, and CISA listed it in the KEV catalogue as actively exploited. ### ACTOR ASSESSMENT Check Point attributes this wave to the Lazarus / DPRK ecosystem. Public Microsoft and CISA materials confirm the vulnerability and exploitation without making that attribution themselves. ### INFERENCE The fact that FudModule previously used a vulnerability in the same AFD.sys driver suggests sustained technical knowledge. That is an interpretation, not evidence of who discovered each bug. ### UNKNOWN The research does not say what defence information was exfiltrated from each victim, who consumed it or whether the operation concretely changed a weapons programme. ## The Romanian question The public material does not disclose a Romanian victim. The research question is still clear: Romanian suppliers of drones, surveillance sensors, robotics and aerospace technology sit in the same technology categories named in the campaign analysis. This is an inference about exposure, not a report of a compromise. ## Sources and limits Current as of 13 August 2026. Re-review if primary sources change the description of exploitation, the CVE-2026-68820 status, the attribution or the limits around victim impact. - [Check Point Research](https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/) · The campaign, malware, relay servers and French victim reuse reconstruction. - [CISA · Known Exploited Vulnerabilities](https://www.cisa.gov/news-events/alerts/2026/08/11/cisa-adds-three-known-exploited-vulnerabilities-catalog) · CVE-2026-68820 listed as actively exploited. - [Microsoft Security Update Guide](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820) · The vulnerability record and Microsoft patch context. - [The Record from Recorded Future News](https://therecord.media/cisa-gives-federal-agencies-two-weeks-to-patch-dprk-microsoft-bug) · Patch and exploitation separated from Check Point’s DPRK attribution.