Lazarus Group, the North Korea-linked hacking operation blamed for billions of dollars in stolen cryptocurrency over the past decade, has done something rare in cyberattack forensics: TechTimes reports the group has now targeted the same Windows driver in four separate attacks since 2022. New research published August 16, 2026 confirms the group exploited a fresh zero-day flaw, CVE-2026-68820, in the Windows AFD.sys network driver, patched by Microsoft on August 11, 2026, to deploy FudModule v3.1, the rootkit’s newest build. Check Point Research found the malware ran undetected inside defense-sector networks for roughly five weeks before defenders spotted it, according to the technical write-up from security research outlet decryptiondigest.com.
The twist is that this is not new territory for Lazarus. TechTimes reported in August 2026 that the group has now exploited the AFD.sys driver family across four attacks dating back to 2022, most recently through CVE-2024-38193 in August 2024 before this latest CVE-2026-68820 flaw. A separate analysis published August 17, 2026 by threat-intel outlet kev.5sn.com carries the headline “The Same Chain, Twice,” documenting how Lazarus returned to the identical driver family with a new kernel primitive but the same rootkit payload each time. For an industry that spends heavily every year on endpoint detection and response (EDR) tooling, a state-backed actor repeatedly defeating that tooling through native Windows components, not third-party junk drivers, four times over four years, is the story security teams are now scrambling to parse.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What CVE-2026-68820 actually is
CVE-2026-68820 is a use-after-free race condition in afd.sys, the Windows kernel driver that manages network socket operations for the Winsock API. Microsoft rates the flaw 7.0 on the CVSS scale and classifies it as “Important” rather than “Critical,” a distinction that matters because it means the bug requires an attacker to already have some level of code execution on the target machine before they can trigger it. It is not a remote, unauthenticated hole; it is a local privilege-escalation bug, and that is precisely the kind of vulnerability that state-sponsored espionage operators favor for the second stage of an attack chain, after initial access has already been won through phishing or a fake job lure.
According to the decryptiondigest.com write-up, the exploit works by racing two competing threads against the same socket state inside afd.sys, a synchronization failure that corrupts freed memory and hands the attacker a kernel read/write primitive. TechTimes confirmed that exploitation grants full SYSTEM-level privileges via afd.sys, letting an attacker with a foothold on a low-privileged user account escalate straight to the highest privilege tier in Windows. Check Point Research found the flaw affected Windows 11 builds 26100 and 26200, and Microsoft shipped the fix for CVE-2026-68820 on August 11, 2026 as part of that month’s Patch Tuesday cycle, meaning organizations that have not yet applied that cumulative update remain exposed even now, weeks later.
FudModule: the rootkit that keeps coming back
FudModule is not a new tool. It was first documented publicly in October 2022 by researchers at ESET and AhnLab, who described it as a Lazarus-linked rootkit that disables security-product monitoring using a bring-your-own-vulnerable-driver (BYOVD) technique. In its earliest form, FudModule shipped alongside a legitimate but flawed Dell driver, exploiting CVE-2021-21551 in dbutil_2_3.sys to gain kernel access before manipulating Windows’ internal data structures from user space.
What makes FudModule unusual, and what antivirus vendor Avast (part of GenDigital) flagged in a February 28, 2024 research report, is that it functions as a “data-only rootkit.” The malicious code itself never runs in kernel mode. Instead, once it secures a kernel read/write primitive, it directly edits kernel objects, handle tables, and security callbacks from user-mode memory. That approach sidesteps kernel-mode code-integrity protections like Driver Signature Enforcement, because FudModule never installs an unsigned kernel driver of its own; it just rewrites the data structures that already exist.
The rootkit’s job, once installed, is to blind the very tools meant to catch it. Avast’s analysis of the 2024 variant found that FudModule specifically targets Protected Process Light (PPL) processes tied to Microsoft Defender and CrowdStrike Falcon, suspending or neutering their callback hooks so that subsequent Lazarus activity on the machine goes unlogged. In the newest 2026 campaign, the objective is the same but broader: the Cloud Security Alliance found that FudModule v3.1 suppressed roughly 94 Event Tracing for Windows (ETW) providers at once, while SC Media reported that the same build also disrupted Windows Smart App Control, so that endpoint detection and response tools on the compromised host stop seeing what Lazarus does next.
From BYOVD to native zero-days: an evolution
Lazarus has steadily upgraded FudModule’s delivery mechanism over four years, and the trajectory tells its own story about how APT groups adapt to defender countermeasures.
| Date disclosed | CVE | Driver | Technique | CVSS |
|---|---|---|---|---|
| October 2022 | CVE-2021-21551 | Dell dbutil_2_3.sys | Classic BYOVD (third-party driver) | N/A (2021-era disclosure) |
| February 13, 2024 | CVE-2024-21338 | appid.sys (AppLocker) | Native Windows kernel zero-day | 7.8 |
| August 2024 | CVE-2024-38193 | afd.sys (AFD/Winsock) | Native Windows kernel zero-day | 7.8 |
| August 2026 (Patch Tuesday) | CVE-2026-68820 | afd.sys (AFD/Winsock) | Native Windows kernel zero-day, race condition | 7.0 |
The shift from row one to row two is the important one. Early FudModule campaigns needed to smuggle in a vulnerable third-party driver, which meant loading unsigned or unusual binaries onto the target machine, something modern EDR products are increasingly tuned to flag. By 2024, Lazarus had stopped bringing its own driver entirely and started hunting for zero-days in drivers that are already present and trusted on every Windows machine on the planet. That is a materially harder problem for defenders, because there is nothing anomalous to spot at the file level; the flawed component is code Microsoft itself shipped and signed.
Inside the August 2026 attack chain
The decryptiondigest.com report ties the CVE-2026-68820 campaign to Lazarus’s long-running “Operation Dream Job” playbook, in which the group poses as recruiters to lure employees at targeted organizations, most often in the defense and aerospace sectors. The August 2026 wave used at least three fake domains branded to look like recruitment pages for Enveil, a real US cybersecurity and privacy-technology firm with no affiliation to the attackers. Check Point Research traced victims across four countries — France, Germany, Brazil, and India — and found the campaign ran inside those defense-firm networks for roughly five weeks before detection, a dwell time consistent with FudModule’s core purpose of keeping EDR tooling blind to follow-on activity.
The mechanics break down into four stages. First, a target opens a lure tied to the fake recruitment domains and executes an initial payload running with standard user privileges. Second, that payload triggers the afd.sys race condition by racing two threads against the same socket object, corrupting freed kernel memory and creating a read/write primitive. Third, with that primitive in hand, the malware escalates to SYSTEM and installs the updated FudModule rootkit. Fourth, FudModule manipulates Windows security callbacks so the kernel-level telemetry that EDR products depend on simply stops flowing, letting Lazarus operators move laterally and exfiltrate data without triggering alerts.
Why this matters beyond one CVE
Security researchers have flagged CVE-2026-68820 as part of a broader and uncomfortable trend: state-sponsored actors increasingly treat EDR bypass as a design requirement, not an afterthought. That shift shows up elsewhere in the September 2026 threat landscape too. Microsoft Defender itself was hit by a publicly released bypass exploit nicknamed “ShieldCrash,” disclosed by an independent researcher immediately after this September’s Patch Tuesday, covered separately in tech-insider.org’s reporting on the Defender bypass. Whether or not the two campaigns are connected, they land in the same month and reflect the same underlying pressure: as EDR products get better at flagging obvious malware, attackers are redirecting effort toward disabling the sensor itself.
That pressure is also visible in the sheer scale of Microsoft’s own September 2026 Patch Tuesday cycle, which fixed roughly 973 flaws including two zero-days already under active exploitation, detailed in tech-insider.org’s Patch Tuesday breakdown. Kernel and driver-level bugs remain one of the largest categories in nearly every monthly Windows update, and each one is a candidate for the next FudModule-style chain.
The EDR-killer problem, compared
FudModule is the most documented example of an “EDR-killer” rootkit, but it sits inside a wider category of tools and techniques designed to blind security software rather than evade it through stealth alone. The table below lays out how FudModule’s approach differs from the more common BYOVD ransomware-affiliate tooling and from software-based EDR-killer utilities sold on criminal forums.
| Technique | Typical operator | Requires unsigned/third-party driver? | Detection difficulty | Primary goal |
|---|---|---|---|---|
| FudModule (data-only rootkit) | Lazarus Group (state-sponsored) | No, since 2024 variants | Very high, no kernel-mode code added | Long-term espionage, EDR blinding |
| Classic BYOVD kits | Ransomware affiliates | Yes, ships a vulnerable signed driver | Moderate, anomalous driver load is detectable | Disable EDR before ransomware deployment |
| Commercial EDR-killer tools (dark web) | Various financially motivated groups | Usually yes | Moderate to low, often signature-known | Quick disablement for smash-and-grab attacks |
| Native zero-day EoP (this campaign) | Lazarus Group | No | Very high, exploits trusted OS code | Privilege escalation feeding rootkit install |
The distinction matters for how defenders prioritize response. Ransomware crews using off-the-shelf BYOVD kits can often be caught by driver allow-listing and blocking known-vulnerable driver hashes, a defense Microsoft has built into its Vulnerable Driver Blocklist. FudModule’s zero-day approach defeats that entirely, since the flawed component is a Microsoft-signed system file already present on every Windows install, not an external driver that can be blocklisted in advance.
Historical context: Lazarus’s rootkit playbook
Lazarus Group has used FudModule across several campaign families since 2022, according to research aggregated on threat-intelligence trackers including Malpedia and Wiz’s cloud threat landscape database. The rootkit has surfaced in connection with the group’s AppleJeus-branded crypto-targeting operations, in follow-on tooling associated with the 2023 3CX supply chain compromise, and repeatedly inside Operation Dream Job-style recruitment lures aimed at defense, aerospace, and technology firms. Avast’s research traced Lazarus’s use of the appid.sys zero-day, CVE-2024-21338, back to at least August 2023, roughly six months before Microsoft patched it in February 2024, meaning the group ran that exploit undetected in the wild for half a year.
That earlier pattern, extended exploitation before a patch ships, then a further gap before defenders build reliable detections, appears again with CVE-2026-68820. The campaign reportedly operated inside defense-sector networks for five weeks even after the underlying flaw had already been addressed in August’s Patch Tuesday release, suggesting either delayed patch deployment at the victim organizations or continued exploitation of already-compromised, unpatched machines discovered through other means.
Chrome’s zero-day count adds to a rough month for browser and OS security
The Lazarus campaign lands in a month when Google also patched its seventh actively exploited Chrome zero-day of 2026, CVE-2026-87491, an out-of-bounds write in the V8 JavaScript engine fixed in Chrome 153.0.8010.36 on September 9, 2026. That flaw is unrelated to CVE-2026-68820 and there is no public evidence tying the two into a single exploit chain. What the two disclosures share is context: 2026 has already produced more actively exploited Chrome zero-days than any prior full year, a pattern tracked in tech-insider.org’s coverage of Chrome’s sixth 2026 zero-day. Combined with Windows kernel bugs like CVE-2026-68820, it points to a browser-plus-OS attack surface that state-sponsored groups are working overtime to find weaknesses in.
Market impact: EDR vendors under fresh scrutiny
For the EDR industry, campaigns like this one are a direct challenge to the core sales pitch: real-time visibility into endpoint behavior. When a nation-state actor can reliably strip that visibility using a kernel primitive rather than malware signatures, security teams are forced to add compensating controls, such as monitoring for gaps in telemetry itself, which is harder to sell and harder to operationalize than a traditional detection rule. Enterprise buyers evaluating EDR and extended detection and response platforms increasingly ask vendors directly about kernel-callback tamper detection, a feature set that only a subset of products currently offer natively. A recent tech-insider.org comparison of major EDR platforms for identity-threat detection found meaningful gaps between vendors on exactly this kind of advanced telemetry-integrity monitoring, detailed in the CrowdStrike vs Defender vs SentinelOne comparison.
Defense contractors and aerospace firms, the sectors named as targets in the August 2026 campaign, sit under some of the tightest cybersecurity compliance regimes in the US, including Cybersecurity Maturity Model Certification (CMMC) requirements tied to Department of Defense contracts. A rootkit that can operate undetected for five weeks inside that sector raises uncomfortable questions about whether current compliance checklists are catching kernel-level tampering at all, or whether they mostly verify the presence of tools rather than the tools’ actual effectiveness against zero-day-enabled bypass.
Patch and mitigation guidance
Organizations that have not yet deployed Microsoft’s August 2026 Patch Tuesday cumulative update remain exposed to CVE-2026-68820 directly. Beyond patching, the specific nature of this campaign calls for a handful of additional steps.
- Apply Microsoft’s August 2026 security updates across every Windows endpoint, not just servers, since the initial foothold in this campaign came through standard user workstations.
- Block the fake Enveil-branded recruitment domains identified in the decryptiondigest.com indicators-of-compromise list, and extend that blocking logic to newly registered domains mimicking cybersecurity or defense-industry recruiters.
- Audit EDR and antivirus telemetry for unexplained gaps or drops, since FudModule’s entire purpose is to silence security callbacks rather than disable the software outright, meaning the agent may appear to run normally while reporting nothing.
- Enable Microsoft’s Vulnerable Driver Blocklist and Windows Defender Application Control (WDAC) where feasible, which won’t stop a native zero-day but closes off the older BYOVD path Lazarus has also used.
- Train staff, particularly in HR and recruiting-adjacent roles at defense and aerospace firms, to treat unsolicited recruiter outreach with the same scrutiny as external phishing, given Lazarus’s consistent reliance on fake job lures since at least 2020.
- Roll patch verification into a documented workflow rather than a one-off push, following the same prioritization logic outlined in tech-insider.org’s guide to CISA’s Known Exploited Vulnerabilities patch workflow, since CVE-2026-68820’s status as an actively exploited kernel bug puts it squarely in that high-priority category.
What comes next: five predictions
Based on Lazarus’s four-year pattern with FudModule and the broader direction of nation-state tooling in 2026, several trends look likely to continue.
- Lazarus will keep hunting for zero-days in native Windows drivers rather than reverting to BYOVD, since the native-driver approach has proven durable against both signature-based and driver-allowlisting defenses for two straight years.
- Expect at least one more FudModule-linked CVE disclosure within the next 12 months, continuing the roughly annual cadence seen since CVE-2024-21338 in February 2024 and CVE-2024-38193 in August 2024.
- EDR vendors will accelerate development of kernel-callback integrity verification as a distinct product feature, marketed separately from traditional behavioral detection, as enterprise buyers start asking about it explicitly during procurement.
- Defense and aerospace firms will face growing pressure from US and allied regulators to demonstrate detection capability against telemetry-blinding rootkits specifically, not just malware presence, as part of updated CMMC and similar compliance frameworks.
- Other state-sponsored groups will likely experiment with similar data-only rootkit techniques now that FudModule’s public documentation has matured, since the approach has proven effective against multiple EDR vendors across three separate CVEs.
Frequently asked questions
What is CVE-2026-68820?
CVE-2026-68820 is a use-after-free race condition vulnerability in afd.sys, the Windows kernel driver that handles Winsock network socket operations. It allows a local attacker who already has code execution on a machine to escalate privileges to SYSTEM. Microsoft rated it 7.0 on the CVSS scale and patched it in the August 2026 Patch Tuesday cycle.
What is the FudModule rootkit?
FudModule is a rootkit first documented in October 2022 and attributed to North Korea’s Lazarus Group. Researchers describe it as a “data-only” rootkit because its malicious code runs entirely in user space; it uses a kernel read/write primitive gained through a privilege-escalation exploit to directly rewrite kernel data structures, disabling security-tool visibility without ever loading unsigned kernel-mode code.
Is this the same as the 2024 FudModule attacks?
It is the same rootkit family and the same driver family, but a different specific vulnerability. Lazarus previously exploited CVE-2024-38193, also in afd.sys, in August 2024, and CVE-2024-21338 in appid.sys in February 2024. The 2026 campaign uses a newly discovered flaw, CVE-2026-68820, again in afd.sys, making this the second time Lazarus has targeted that particular driver.
Which sectors were targeted in the August 2026 campaign?
Reporting from decryptiondigest.com ties the campaign to defense-sector organizations, consistent with Lazarus’s long-running Operation Dream Job playbook, which uses fake recruiter outreach, in this case impersonating cybersecurity firm Enveil, to gain initial access.
How do I know if my organization is protected?
Confirm that Microsoft’s August 2026 security updates have been applied to every Windows endpoint, not only servers. Because FudModule specifically targets EDR telemetry rather than triggering conventional malware alerts, organizations should also review their security tooling for unexplained gaps in logging or callback activity rather than relying solely on the absence of active alerts.
Does this affect macOS or Linux systems?
No. CVE-2026-68820 is specific to the Windows afd.sys driver, and the FudModule rootkit is built to manipulate Windows kernel data structures and security callbacks. It has no direct equivalent reported on macOS or Linux, though Lazarus has separately used other tooling, including trojanized macOS trading apps in its AppleJeus campaigns, on non-Windows platforms.
Why can’t standard antivirus catch this rootkit?
Because FudModule never installs unsigned or unusual kernel-mode code, the file-level and driver-level checks that catch most rootkits don’t apply. It gains its foothold by exploiting a genuine, Microsoft-signed system driver already present on every Windows machine, then edits that driver’s in-memory data structures rather than deploying a new malicious binary. Detection depends on identifying anomalous kernel object states or missing security-callback activity rather than spotting a suspicious file.
What should defense contractors do right now?
Beyond patching, defense-sector security teams should treat any unsolicited recruiter contact with heightened scrutiny, verify EDR telemetry continuity across endpoints rather than trusting a quiet dashboard, and review Microsoft’s Vulnerable Driver Blocklist and Windows Defender Application Control configurations, which help close off the older BYOVD variants of this same rootkit even though they cannot stop the native zero-day path used in the 2026 campaign.
