CVE-2026-68820: Lazarus Exploits Windows Zero-Day in Operation Dream Job — Defense Detection & Response Guide | Security Arsenal

North Korean state-sponsored operators attributed to the Lazarus Group (also tracked as Diamond Sleet / TEMP.Hermit) are actively exploiting CVE-2026-68820, a currently unpatched Windows vulnerability, in targeted intrusions against defense-sector companies. The attacks ride on the long-running Operation Dream Job playbook: fake recruiter outreach, fraudulent job offers, and trojanized documents that now carry a zero-day payload instead of commodity loaders.

This is a confirmed in-the-wild exploitation campaign — not theoretical. If your organization sits in the defense industrial base (DIB), aerospace, or adjacent supply chains, treat this as an active intrusion campaign with dwell time measured in days, not months. The attackers' objective set historically includes intellectual property theft, persistent access for intelligence collection, and staging for supply-chain pivoting.

Because no vendor patch is available yet, your defense-in-depth posture — detection engineering, attack surface reduction, and aggressive hunting — is the entire game right now.

Technical Analysis

What We Know

Vulnerability: CVE-2026-68820 — an unpatched Windows flaw exploited as a zero-day. At time of writing, Microsoft has not released a fix; CVSS scoring and full technical root cause have not been formally published. Until vendor guidance lands, assume the defect enables code execution or privilege escalation in the context of the exploited component.
Threat actor: Lazarus Group, DPRK-nexus, financially and intelligence-motivated, with a decade-long track record of DIB targeting (WannaCry-era tooling lineage through modern Operation Dream Job variants).
Delivery vector: Operation Dream Job social engineering — LinkedIn/email-based recruiter personas offering lucrative positions at defense firms, delivering malicious documents (Word/PDF lures) or trojanized "job description" archives.
Exploitation status: Confirmed active exploitation in the wild against real targets. Zero-day at time of disclosure. Expect rapid CISA KEV addition once the CVE is fully published — monitor it daily.

Typical Operation Dream Job Attack Chain (Defender's View)

Based on documented Lazarus tradecraft, the intrusion chain you should be hunting follows this shape:

Initial contact — spear-phishing email or social media message containing a malicious document (.docx, .pdf) or an archive with a trojanized viewer/application.
Execution — the lure document triggers exploitation of CVE-2026-68820, or drops a first-stage loader. Observable: Office applications (winword.exe, excel.exe) or archive viewers spawning anomalous child processes.
Payload staging — LOLBin abuse is a Lazarus signature: rundll32.exe, regsvr32.exe, or mshta.exe executing payloads from %TEMP%, %APPDATA%, or %ProgramData%.
Persistence — Run keys, scheduled tasks masquerading as system updaters, or services.
C2 and collection — HTTPS beaconing to attacker infrastructure, frequently fronted through compromised legitimate domains; staged collection of technical documentation and credentials.

The zero-day changes stage 2, not the rest of the kill chain — which means your existing behavioral detections for stages 3–5 remain fully effective and are your highest-leverage investment this week.

Detection & Response

The Sigma rules below target the post-exploitation behaviors that are invariant regardless of the underlying zero-day. These are tuned to avoid the classic false-positive storms (e.g., we scope Office child processes to scripting/LOLBin children, not all children).

YAML

---
title: Office Application Spawning Scripting or LOLBin Child Process
description: Detects Office applications (Word, Excel, PowerPoint) spawning command shells, script interpreters, or LOLBins — a hallmark of malicious document exploitation as seen in Operation Dream Job campaigns delivering CVE-2026-68820.
author: Security Arsenal
date: 2026/04/06
status: experimental
references:
  - https://www.bleepingcomputer.com/news/security/lazarus-hackers-exploited-windows-zero-day-to-target-defense-firms/
  - https://attack.mitre.org/techniques/T1204/
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\mspub.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate Office add-ins spawning these processes are uncommon in hardened environments
level: high
---
title: LOLBin Loading Binary From User-Writable Directory
description: Detects rundll32, regsvr32, or mshta executing payloads from TEMP, AppData, or ProgramData — consistent with Lazarus first-stage loader staging after exploitation of CVE-2026-68820.
author: Security Arsenal
date: 2026/04/06
status: experimental
references:
  - https://www.bleepingcomputer.com/news/security/lazarus-hackers-exploited-windows-zero-day-to-target-defense-firms/
  - https://attack.mitre.org/techniques/T1218/
logsource:
  category: process_creation
  product: windows
detection:
  selection_lolbin:
    Image|endswith:
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
  selection_path:
    CommandLine|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\ProgramData\'
  filter_signed:
    CommandLine|contains:
      - '\ProgramData\Microsoft\'
  condition: selection_lolbin and selection_path and not filter_signed
falsepositives:
  - Software installers and some enterprise deployment tools; baseline and tune the filter per environment
level: high
---
title: Scheduled Task Masquerading as System Update Created by Non-System Process
description: Detects persistence via scheduled tasks using update-themed names created outside of legitimate Windows servicing — a documented Lazarus persistence pattern in Operation Dream Job intrusions.
author: Security Arsenal
date: 2026/04/06
status: experimental
references:
  - https://attack.mitre.org/techniques/T1053/005/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains:
      - '/create'
  selection_name:
    CommandLine|contains:
      - 'Update'
      - 'Service'
      - 'Maintenance'
  filter_parents:
    ParentImage|endswith:
      - '\msiexec.exe'
      - '\TiWorker.exe'
  condition: selection and selection_name and not filter_parents
falsepositives:
  - IT deployment scripts and software updaters; whitelist known admin tooling
level: medium

The KQL hunt below sweeps Defender for Endpoint telemetry for the core Dream Job execution pattern — Office or archive-viewer processes handing off to script interpreters and LOLBins, enriched with network activity on the same devices within the same window.

KQL — Microsoft Sentinel / Defender

let timeframe = 14d;
let suspiciousParents = dynamic(["winword.exe", "excel.exe", "powerpnt.exe", "mspub.exe", "acrord32.exe", "7zfm.exe", "winrar.exe"]);
let suspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "wscript.exe", "cscript.exe", "certutil.exe", "bitsadmin.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(timeframe)
| where InitiatingProcessFileName in~ (suspiciousParents)
| where FileName in~ (suspiciousChildren)
| project DeviceId, DeviceName, TimeGenerated, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, SHA256
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(timeframe)
    | where InitiatingProcessFileName in~ (suspiciousChildren)
    | project DeviceId, NetTime=TimeGenerated, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
) on DeviceId, FileName=InitiatingProcessFileName
| summarize ExecutionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), RemoteDestinations = make_set(RemoteUrl, 20) by DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by LastSeen desc

For endpoint forensics at scale, this Velociraptor artifact hunts live systems for LOLBin processes executing from user-writable paths and cross-references recently created scheduled tasks — the two artifacts most likely to survive on a Lazarus-compromised host.

VQL — Velociraptor

-- Hunt for LOLBin execution from user-writable paths plus update-themed scheduled tasks
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)rundll32|regsvr32|mshta')
  AND (CommandLine =~ '(?i)AppData|ProgramData|Users\\\\Public|Temp')
  AND NOT CommandLine =~ '(?i)ProgramData\\\\Microsoft'

Remediation Script

Until Microsoft ships a fix for CVE-2026-68820, the controls that matter are Attack Surface Reduction rules that break the exploitation chain, Protected View hardening, and verification of patch readiness. Run this PowerShell as Administrator on endpoints (or deploy via Intune/GPO — the script also works as a compliance check).

PowerShell

#Requires -RunAsAdministrator
# CVE-2026-68820 zero-day interim hardening — Operation Dream Job / Lazarus
# Deploy ASR mitigations that break the document-exploitation-to-child-process chain

$asrRules = @{
    # Block Office applications from creating child processes
    "D4F940AB-401B-4EFC-AADC-AD5F3C50688A" = 1
    # Block Office applications from creating executable content
    "3B576869-A4EC-4529-8536-B80A7769E899" = 1
    # Block Office communication apps from creating child processes
    "26190899-1602-49E8-8B27-EB1D0A1CE869" = 1
    # Block execution of potentially obfuscated scripts
    "5BEB7EFE-FD9A-4556-801D-275E5FFC04CC" = 1
    # Block Win32 API calls from Office macros
    "92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B" = 1
    # Block process creations from PSExec and WMI commands (lateral movement mitigation)
    "D1E49AAC-8F56-4280-B9BA-993A6D77406C" = 1
}

foreach ($ruleId in $asrRules.Keys) {
    Add-MpPreference -AttackSurfaceReductionRules_Ids $ruleId -AttackSurfaceReductionRules_Actions $asrRules[$ruleId] -ErrorAction SilentlyContinue
}

# Verify ASR rule state — 1 = Block, 2 = Audit
Write-Host "`n=== ASR Rule State ===" -ForegroundColor Cyan
$mpPref = Get-MpPreference
for ($i = 0; $i -lt $mpPref.AttackSurfaceReductionRules_Ids.Count; $i++) {
    if ($asrRules.ContainsKey($mpPref.AttackSurfaceReductionRules_Ids[$i])) {
        Write-Host ("{0} : Action {1}" -f $mpPref.AttackSurfaceReductionRules_Ids[$i], $mpPref.AttackSurfaceReductionRules_Actions[$i])
    }
}

# Force Protected View for Office documents from the internet (breaks silent exploitation of file-borne zero-days)
$officeVersions = @("16.0")
foreach ($ver in $officeVersions) {
    foreach ($app in @("Word", "Excel", "PowerPoint")) {
        $path = "HKCU:\Software\Policies\Microsoft\Office\$ver\$app\Security\ProtectedView"
        if (-not (Test-Path $path)) { New-Item -Path $path -Force | Out-Null }
        Set-ItemProperty -Path $path -Name "DisableInternetFilesInPV" -Value 0 -Type DWord
        Set-ItemProperty -Path $path -Name "DisableAttachmentsInPV" -Value 0 -Type DWord
        Set-ItemProperty -Path $path -Name "DisableUnsafeLocationsInPV" -Value 0 -Type DWord
    }
}
Write-Host "`n=== Protected View enforced for internet-origin documents ===" -ForegroundColor Cyan

# Audit for suspicious persistence planted by Dream Job loaders
Write-Host "`n=== Suspicious Scheduled Tasks (update-themed, non-Microsoft) ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {
    $_.TaskName -match 'Update|Maintenance|Service' -and
    $_.TaskPath -notmatch 'Microsoft' -and
    ($_.Actions.Execute -match 'AppData|ProgramData|Temp|rundll32|regsvr32|mshta')
} | Format-Table TaskName, TaskPath, @{N='Action';E={$_.Actions.Execute}} -AutoSize

# Check last installed update date — flag endpoints not patched in 30 days for when the CVE-2026-68820 fix ships
Write-Host "`n=== Patch Recency Check ===" -ForegroundColor Cyan
$lastHotfix = Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1
$daysSince = (New-TimeSpan -Start $lastHotfix.InstalledOn -End (Get-Date)).Days
Write-Host ("Last update: {0} ({1} days ago)" -f $lastHotfix.HotFixID, $daysSince)
if ($daysSince -gt 30) { Write-Warning "Endpoint is >30 days behind on updates — prioritize when the CVE-2026-68820 patch releases." }

Remediation

Immediate (this week):

Deploy the ASR rules above in block mode — the "Block Office applications from creating child processes" rule alone severs the exploitation chain for the vast majority of document-borne zero-days, including this campaign's delivery model. Pilot on a test OU for 48 hours if you must, but do not leave it in audit.
Enforce Protected View and block macros from internet-origin documents across the estate via GPO/Intune.
Hunt retroactively — run the KQL query across at least 30 days of telemetry, prioritizing users in engineering, program management, HR, and executive staff at DIB-adjacent business units. These are the Dream Job target personas.
Block known Lazarus infrastructure at the egress proxy and enable DNS sinkholing for newly registered domains masquerading as defense contractors and job portals.

When the patch ships:

Microsoft's advisory for CVE-2026-68820 will land at MSRC Security Update Guide — subscribe to MSRC notifications now so the release doesn't surprise you.
Given confirmed in-the-wild exploitation, expect this CVE to enter CISA's Known Exploited Vulnerabilities catalog with a federal remediation deadline (typically 21 days for FCEB agencies, and a strong benchmark for everyone else). Pre-stage your patch rings now so you can hit that window without change-freeze drama.
Do not wait for the patch to consider this handled — zero-days exploited by Lazarus have historically been paired with already-established persistence. Assume compromise on any host showing the execution patterns above and trigger full IR triage: memory capture, credential rotation for logged-on users, and lateral movement review.

Strategic:

If you're in the DIB, this campaign reinforces why CMMC-aligned email and attachment sandboxing with content disarm and reconstruction (CDR) is table stakes, and why recruiter-impersonation awareness training needs to target HR and engineering specifically — Dream Job works precisely because the lure is plausible and personalized.
Detonate all inbound Office documents and archives in a sandbox that detonates against your actual production Office build — signature-less sandbox evasion fails when the exploit simply doesn't fire in the analysis VM.

Security Arsenal's threat hunting and incident response teams are tracking this campaign. If your organization handles defense-sector contracts and you suspect Dream Job targeting, time-to-triage is the metric that matters.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub

CVE-2026-68820: Lazarus Exploits Windows Zero-Day in Operation Dream Job — Defense Detection & Response Guide