Lazarus Group Strikes Again: Fake Job Offers, Real Zero-Days — India in the Crosshairs
North Korea's state-sponsored Lazarus Group is back in the headlines — and this time, the campaign hits closer to home for Indian defense-sector professionals. What Happened Security researchers at Check Point have attributed a new wave of attacks to Lazarus Group, part of their long-running "Operation Dream Job" campaign. The group is exploiting a freshly patched Windows zero-day vulnerability — CVE-2026-68820 — to deliver a never-before-seen backdoor targeting defense and aerospace companies across France, Germany, Brazil, and India. The Attack Chain Social Engineering First — Attackers pose as recruiters from well-known defense firms like Lockheed Martin, sending fake but convincing job offers to professionals in the sector. Zero-Day Exploitation — Once a target engages, the attackers exploit a privilege escalation flaw in AFD.sys (Windows Ancillary Function Driver for WinSock) — CVSS 7.0 — to gain SYSTEM-level access. Backdoor Deployment — A custom, previo...