Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack · 2026-08-11
Check Point Research is tracking a long‑running campaign called Operation Dream Job, targeting organizations worldwide, with a particular focus on the defense sector. The campaign is affiliated to DPRK-linked Lazarus group and its latest wave focuses on the defense sector in Europe and India.
17th August – Threat Intelligence Report · 2026-08-17
Check Point Research has exposed a new wave of the Lazarus-linked Operation Dream Job targeting defense organizations in Europe, India and Brazil. Attackers used fraudulent job opportunities and trojanized PDF software to deploy malware, while exploiting Windows zero-day CVE-2026-68820 to obtain SYSTEM privileges and disable security visibility.
Defense, aerospace and aviation organizations in Europe and India · 2026-08-11
Check Point Researchers reveal that Lazarus Group is exploiting the Windows zero-day CVE-2026-68820 alongside new Troy and RelayShell malware to target defense and aerospace firms in Europe and India. [Date Occurred: Since July 2026; Date Discovered: Since July 2026]
북한 해킹조직 라자루스, 윈도 제로데이 실제 공격…MS 8월 긴급 패치 · 2026-08-12
attribution sentence(s): 체크포인트 리서치는 북한 연계 해킹그룹 라자루스(Lazarus)가 이 취약점을 제로데이 상태에서 ‘오퍼레이션 드림 잡(Operation Dream Job)’ 공격에 사용했다고 분석했다. | 체크포인트는 라자루스가 방산·항공우주 분야 등을 겨냥한 공격에서 이 취약점을 사용했다고 밝혔다. | 특히 방산·항공우주 등 라자루스의 공격 대상이 될 가능성이 높은 조직은 윈도 보안 업데이트 적용과 함께 EDR 이상 동작, 의심스러운 채용 관련 파일과 프로그램 실행 흔적도 점검할 필요가 있다"고 권고했다.
CVE-2026-68820 afd.sys zero-day exploitation in Operation Dream Job (in CISO Risk Intel Brief Aug 19 2026) · 2026-08-19T19:22:32+00:00
Public reporting attributes exploitation to North Korea-linked Lazarus Group activity within Operation Dream Job, often following social-engineering job lures and leading to deployment of the FudModule rootkit.
CVE-2026-68820 zero-day (in CISO Risk Intel Brief Aug 12 2026) · 2026-08-13T16:21:16+00:00
Microsoft’s 11 August Patch Tuesday addressed 421 CVEs, including the actively exploited zero-day CVE-2026-68820 used by North Korean Lazarus-linked actors to achieve SYSTEM privileges and deploy a kernel-mode rootkit.
Lazarus afd.sys zero-day in Operation Dream Job against defense and aerospace (in CISO Risk Intel Brief Aug 26 2026) · 2026-08-26T19:22:32+00:00
Lazarus (DPRK) exploited a Windows afd.sys zero-day (CVE-2026-68820) in Operation Dream Job against defense and aerospace targets. ... Targets in France, Germany, Brazil, India (defense, aerospace, aviation).
DPRK nation-state incident count H1 2026 (in CISO Risk Intel Brief Sept 2 2026) · 2026-09-02T20:24:35+00:00
Nation-state volume, on H1 2026 telemetry published in mid-August, rose 7.5 percent versus the prior six months (179 versus 147 incidents): DPRK 99, China 33 (fewer incidents, more covert collection), Russia 26 (up 30 percent, expanding past Ukraine into Poland and Romania). ... DPRK continues to combine crypto-theft, fake recruiting (now observed beyond IT into healthcare and sales roles), and compromised repositories.