Operation Dream Job: From Job Offers to Zero‑Day Attacks on Defense Sectors

In the early months of 2026, a new wave of the long‑running Operation Dream Job campaign emerged, this time honing in on the defense, aerospace, and aviation industries. The attackers, linked to the DPRK‑affiliated Lazarus group, have refined their delivery tactics to look like legitimate recruitment outreach, turning a simple job offer into a weaponized zero‑day attack.

How the Attack Begins

• Spear‑phishing lures – Targets receive enticing job offers via LinkedIn, professional forums or direct messaging. The attackers pose as recruiters from well‑known defense contractors.
• Malicious download – Victims are directed to a spoofed recruitment site that hosts a trojanized PDF viewer called SecurityPDF. The site is SEO‑optimized to appear legitimate in search results.
• Execution – Opening a specially crafted PDF triggers the embedded payload, installing the first stage of the attack chain.

From User‑Space to Kernel‑Space

The initial payload drops a lightweight backdoor that leverages a newly discovered local privilege escalation (LPE) zero‑day, CVE‑2026‑68820, in Microsoft’s AFD.sys driver. Once SYSTEM privileges are achieved, the malware deploys FudModule, a custom kernel‑mode rootkit that hooks critical system calls and disables most endpoint detection and response (EDR) solutions.

Command‑and‑Control via Compromised Web Servers

Parallel to the kernel‑mode infection, the threat actor exploits CVE‑2025‑49113 in vulnerable Roundcube webmail installations. The resulting RelayShell PHP webshell turns the compromised mail server into a covert relay node, allowing the attackers to tunnel traffic through legitimate infrastructure and evade perimeter defenses.

Exploitation of the Defense Sector’s Reputation

In at least one documented instance, a Western European defense contractor’s compromised mail server was used to launch a spear‑phishing campaign. By leveraging the organization’s brand, the attackers were able to bypass user vigilance and deliver additional payloads to new victims.

Mitigation and Response

• Apply the August 2026 Patch Tuesday update that addresses CVE‑2026‑68820.
• Patch all Roundcube installations to the latest version to close CVE‑2025‑49113.
• Deploy host‑based intrusion detection capable of spotting kernel‑mode rootkits like FudModule.
• Implement strict email authentication (DMARC, SPF, DKIM) to reduce the effectiveness of spoofed recruitment emails.
• Monitor for unusual outbound traffic from webmail servers and enforce least‑privilege access controls.

“The campaign’s blend of social engineering, zero‑day exploitation, and server‑side relays demonstrates a sophisticated, multi‑layered approach that is hard to detect with traditional security tools,” said a Check Point Research analyst.