Lazarus Group Exploits Unpatched Windows Vulnerability in New Operation Dream Job Wave — Detection and Remediation Guide

Check Point Research has uncovered a new wave of Operation Dream Job, the long-running North Korean intrusion campaign attributed to the Lazarus Group (also tracked as Diamond Sleet, TEMP.Hermit, and within the broader DPRK APT38/37 ecosystem). This iteration targets defense and aerospace professionals with convincing fake job offers impersonating Lockheed Martin recruiters — and, critically, it weaponizes an unpatched Windows vulnerability to deploy an unauthorized access mechanism while evading endpoint security controls.

That combination should get every SOC lead's attention. Zero-days are typically rationed — burned only when the target justifies the exposure of an expensive capability. Lazarus spending an unpatched Windows flaw on defense-sector social engineering tells us two things: the intelligence value of defense-industrial-base personnel remains extremely high for Pyongyang, and the group is confident enough in its lure infrastructure to pair it with its best tooling. If your organization operates in defense, aerospace, or adjacent supply chains — or employs people with those backgrounds — you are in the blast radius of this campaign.

This post breaks down the attack chain as currently understood, and gives you the detection logic, hunt queries, and hardening steps to find and stop it before the lure becomes a foothold.

Technical Analysis

Who Is Being Targeted

The campaign's victimology is consistent with historical Operation Dream Job activity but sharpened for 2025–2026:

• Primary targets: Engineers, program managers, and technical staff at defense contractors, aerospace firms, and satellite/space companies
• Lure persona: Recruiters and talent-acquisition staff claiming to represent Lockheed Martin
• Delivery channels: LinkedIn direct messages, personal email addresses harvested from professional profiles, and follow-up correspondence that moves targets to weaponized attachments or trojanized "job description" packages

The social engineering is deliberately patient. Lazarus operators historically invest weeks in rapport-building before delivering a payload, which means your telemetry may show the lure long before you see exploitation — if you're looking at the right places.

The Attack Chain (Defender's View)

Based on Check Point Research's reporting on this wave, the intrusion follows this shape:

1. Spear-phishing delivery (TA0001): The victim receives a fake job offer — typically a document or archive themed around a Lockheed Martin position. These lures are high-quality, often referencing real requisitions scraped from public job boards.
2. User-assisted initial execution (T1204): The victim opens the lure, which triggers the exploit chain. Because this wave abuses an unpatched Windows vulnerability, execution can proceed without the classic "enable macros" friction that gives defenders a second chance.
3. Vulnerability exploitation (T1203): The weaponized content abuses the Windows flaw to execute attacker-controlled code in a context that bypasses or weakens standard endpoint security controls. The reporting indicates the exploit is used specifically to deploy an unauthorized access mechanism — in Lazarus tradecraft, this means an implant or loader staged with minimal on-disk footprint.
4. Defense evasion (TA0005): Lazarus consistently favors DLL side-loading via signed legitimate binaries, in-memory payload staging, and process injection into trusted Windows processes. Expect the implant to live inside or alongside a legitimately signed Microsoft or third-party binary rather than as an obvious unsigned executable.
5. Persistence (TA0003): Historical Dream Job implants persist via Run registry keys, scheduled tasks masquerading as update jobs, and service creation with plausible-sounding names.
6. Command and control (TA0011): C2 typically rides HTTPS to compromised legitimate infrastructure or CDN-fronted domains, with long beacon intervals designed to blend into background enterprise traffic.

Exploitation Status

• Vulnerability class: Unpatched Windows vulnerability (zero-day at time of reporting). No CVE identifier has been publicly assigned in the source reporting — do not assume one. Until Microsoft issues an advisory and patch, treat this as an unmitigated exposure.
• Status: Confirmed active exploitation in the wild as part of a targeted nation-state campaign.
• Attribution: Lazarus Group / DPRK, high confidence per Check Point Research.
• CISA KEV: Monitor the CISA Known Exploited Vulnerabilities catalog — confirmed in-the-wild Windows zero-days are typically added rapidly once a CVE is assigned, with binding remediation deadlines for federal agencies and a strong signal for everyone else.

Why This Is Harder to Catch Than Commodity Malware

Three characteristics make this campaign hostile to naive detection:

1. No patch exists yet. You cannot "fix" your way out of this today — detection and compensating controls are your only options until Microsoft ships.
2. The lure is bespoke. Generic phishing heuristics tuned for bulk campaigns will not fire on a hand-crafted, low-volume, high-quality lure sent to a handful of individuals.
3. The implant hides behind signed binaries. Hash-based and signature-based controls are near-useless; behavior is the only reliable tripwire.

Detection & Response

The detections below are built around the observable behaviors of this campaign class: lure documents spawning unexpected child processes, LOLBin-driven staging, persistence establishment, and implant-style network beacons. Every rule is scoped to minimize noise in a real enterprise.

SIGMA Rules

---
title: Office or Document Process Spawning Scripting or LOLBin Child Process
description: Detects document-handling processes (WINWORD, EXCEL, Acrobat, archivers) spawning script interpreters or LOLBins — consistent with malicious job-offer lures weaponized with an exploit chain, as seen in Operation Dream Job.
author: Security Arsenal
date: 2026/01/20
status: experimental
references:
  - https://securityaffairs.com/197098/uncategorized/north-korean-lazarus-group-uses-windows-zero-day-in-operation-dream-job.html
  - https://attack.mitre.org/techniques/T1204/
  - https://attack.mitre.org/techniques/T1059/
tags:
  - attack.execution
  - attack.initial_access
  - attack.t1204
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\acrord32.exe'
      - '\acrobat.exe'
      - '\winrar.exe'
      - '\7zfm.exe'
      - '\msedge.exe'
      - '\explorer.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wmic.exe'
  filter_explorer_edge:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\msedge.exe'
    CommandLine|contains:
      - '--type='
  condition: selection_parent and selection_child and not filter_explorer_edge
falsepositives:
  - Legitimate document templates invoking scripting in tightly managed environments (rare)
level: high
---
title: Rundll32 Executing DLL From User-Writable or Temp Location
description: Detects rundll32 or regsvr32 loading DLLs from temp, AppData, or Public directories — a hallmark of Lazarus implant staging and DLL side-loading chains used to evade security controls.
author: Security Arsenal
date: 2026/01/20
status: experimental
references:
  - https://securityaffairs.com/197098/uncategorized/north-korean-lazarus-group-uses-windows-zero-day-in-operation-dream-job.html
  - https://attack.mitre.org/techniques/T1218/
  - https://attack.mitre.org/techniques/T1574/002/
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218.011
  - attack.t1574.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_loader:
    Image|endswith:
      - '\rundll32.exe'
      - '\regsvr32.exe'
  selection_path:
    CommandLine|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\ProgramData\'
      - '\Windows\Temp\'
  condition: selection_loader and selection_path
falsepositives:
  - Some software updaters staging DLLs in AppData (tune per-environment baselines)
level: high
---
title: Persistence via Run Key or Scheduled Task With Masquerading Name
description: Detects registry Run key or scheduled task persistence using names themed as system/update components — consistent with Operation Dream Job implant persistence tradecraft.
author: Security Arsenal
date: 2026/01/20
status: experimental
references:
  - https://securityaffairs.com/197098/uncategorized/north-korean-lazarus-group-uses-windows-zero-day-in-operation-dream-job.html
  - https://attack.mitre.org/techniques/T1060/
  - https://attack.mitre.org/techniques/T1053/005/
tags:
  - attack.persistence
  - attack.t1060
  - attack.t1053.005
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\CurrentVersion\Run'
      - '\CurrentVersion\RunOnce'
  selection_value:
    Details|contains:
      - '\AppData\'
      - '\Users\Public\'
      - '\Temp\'
      - 'rundll32'
      - 'regsvr32'
  condition: selection_key and selection_value
falsepositives:
  - Legitimate per-user applications registering autostart entries from AppData (e.g., Teams, OneDrive) — baseline and exclude known-good
level: medium

KQL — Microsoft Sentinel / Defender Hunt

This query hunts the full kill chain: document/lure processes spawning LOLBins, implant-style DLL loads from user-writable paths, and persistence registration — correlated on the same device within a hunt window.

// Hunt: Operation Dream Job-style lure execution and implant staging
let Lookback = 14d;
let LureParents = dynamic(["winword.exe","excel.exe","powerpnt.exe","acrord32.exe","acrobat.exe","winrar.exe","7zfm.exe"]); 
let LOLBins = dynamic(["powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","wmic.exe"]);
let SuspiciousPaths = dynamic(["\\AppData\\Local\\Temp\\","\\AppData\\Roaming\\","\\Users\\Public\\","\\ProgramData\\"]);
// Stage 1: Lure process spawning a LOLBin
let LureExec = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName has_any (LureParents)
| where FileName has_any (LOLBins)
| project DeviceId, DeviceName, LureTime=TimeGenerated, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, SHA256;
// Stage 2: DLL/loader execution from user-writable paths on the same device
let ImplantStaging = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ ("rundll32.exe","regsvr32.exe")
| where ProcessCommandLine has_any (SuspiciousPaths)
| project DeviceId, StageTime=TimeGenerated, LoaderCmd=ProcessCommandLine, LoaderSHA=SHA256, AccountName;
// Correlate: devices showing both behaviors are your triage priority
LureExec
| join kind=inner ImplantStaging on DeviceId
| where StageTime between (LureTime .. LureTime + 2h)
| project DeviceName, AccountName, LureTime, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, StageTime, LoaderCmd
| order by LureTime desc;

Velociraptor VQL — Endpoint Hunt Artifact

Use this artifact across your fleet to surface processes loading modules from non-standard paths and persistence entries pointing at user-writable locations — the forensic residue of a Dream Job implant even after the lure document is deleted.

-- Hunt for Lazarus Dream Job implant indicators:
-- 1) Processes executing from user-writable/temp paths
-- 2) Run-key persistence pointing at suspicious locations
LET procs = SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(AppData|Users\\Public|ProgramData|Temp)\\'
  AND NOT Exe =~ '(?i)(OneDrive|Teams|Spotify|Slack|Zoom)'

LET runkeys = SELECT Name AS ValueName,
       FullPath AS KeyPath,
       String AS Command
FROM glob(globs=[
  'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\*',
  'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*',
  'HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\*'
], accessor='registry')
WHERE Command =~ '(?i)(AppData|Users\\Public|Temp|rundll32|regsvr32)'

SELECT * FROM procs
UNION ALL
SELECT 0 AS Pid, ValueName AS Name, KeyPath AS Exe,
       Command AS CommandLine, '' AS Username, NULL AS CreateTime
FROM runkeys

Remediation & Hardening Script

Until Microsoft ships a patch for the exploited vulnerability, compensating controls are the remediation. This PowerShell script applies the highest-leverage mitigations for lure-driven exploitation: attack surface reduction (ASR) rules, Office child-process blocking, and a verification pass over common persistence locations.

# Security Arsenal — Operation Dream Job Compensating Controls
# Run elevated. Test in Audit mode first in production environments.

# --- 1) Enable ASR rules blocking the most common lure execution paths ---
# Block Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions Enabled

# Block Office apps from creating executable content
Set-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 `
  -AttackSurfaceReductionRules_Actions Enabled

# Block Office apps from injecting code into other processes
Set-MpPreference -AttackSurfaceReductionRules_Ids 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
  -AttackSurfaceReductionRules_Actions Enabled

# Block execution of potentially obfuscated scripts
Set-MpPreference -AttackSurfaceReductionRules_Ids 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC `
  -AttackSurfaceReductionRules_Actions Enabled

# Block untrusted/unsigned processes from running from USB (covering lure archives on removable media)
Set-MpPreference -AttackSurfaceReductionRules_Ids B2B3F03D-6A65-4F7B-A9C7-1C7EF74A9BA4 `
  -AttackSurfaceReductionRules_Actions Enabled

# --- 2) Force Mark-of-the-Web compliance: block macros in files from the internet ---
$officePolicy = 'HKLM:\SOFTWARE\Policies\Microsoft\Office\16.0\Word\Security'
New-Item -Path $officePolicy -Force | Out-Null
Set-ItemProperty -Path $officePolicy -Name 'blockcontentexecutionfrominternet' -Value 1

# --- 3) Audit persistence locations for Dream Job-style implants ---
Write-Host '[*] Auditing Run keys for entries pointing at user-writable paths...' -ForegroundColor Cyan
$runKeys = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
)
foreach ($key in $runKeys) {
  if (Test-Path $key) {
    (Get-ItemProperty $key).PSObject.Properties | Where-Object {
      $_.Value -match 'AppData|Public|Temp|rundll32|regsvr32'
    } | ForEach-Object {
      Write-Host "[!] SUSPICIOUS: $($_.Name) = $($_.Value) in $key" -ForegroundColor Red
    }
  }
}

# --- 4) Audit scheduled tasks for masquerading persistence ---
Write-Host '[*] Auditing scheduled tasks with suspicious action paths...' -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.State -ne 'Disabled' } | ForEach-Object {
  $actions = $_.Actions | Where-Object {
    $_.Execute -match 'AppData|Public|Temp' -or $_.Execute -match 'rundll32|regsvr32|mshta|wscript'
  }
  if ($actions) {
    Write-Host "[!] SUSPICIOUS TASK: $($_.TaskName) -> $($actions.Execute) $($actions.Arguments)" -ForegroundColor Red
  }
}

# --- 5) Verify ASR rules applied ---
Write-Host '[*] Verifying ASR rule state...' -ForegroundColor Cyan
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids

Remediation

Immediate (0–24 hours)

1. Treat this as an unpatched exposure — there is no fix to deploy yet. The vulnerability exploited in this campaign has no public CVE or vendor patch as of this writing. Compensating controls are your remediation path until Microsoft releases an advisory and update. Monitor Microsoft's Security Update Guide and the CISA KEV catalog daily; KEV additions carry binding deadlines for federal civilian agencies (typically 21 days, often shorter for zero-days) and should drive your own SLA.
2. Deploy the ASR rules above — start in Audit mode if you must, but the Office child-process and code-injection rules have exceptionally low false-positive rates in most enterprises and directly break this campaign's execution chain.
3. Brief your highest-risk population. Defense and aerospace staff with LinkedIn profiles referencing clearances, program names, or prior Lockheed Martin employment are the targeting pool. A short, specific warning — "be suspicious of unsolicited recruiter contact referencing Lockheed Martin roles, especially anything with attachments or archive downloads" — is worth more than another annual phishing module.
4. Run the KQL and VQL hunts across your estate, prioritizing devices belonging to engineering, program management, and executive staff.

Short Term (1–2 weeks)

5. Constrain inbound lure delivery: enforce strict attachment sandboxing and detonation for archives and documents from external senders; strip or rewrite password-protected archives (a classic AV-evasion wrapper for exploit-laden lures).
6. Harden email authentication and monitoring for impersonation: alert on inbound mail failing DMARC while displaying defense-contractor sender names, and monitor for lookalike domains spoofing Lockheed Martin recruiting infrastructure.
7. Block or tightly control LOLBins (mshta, wscript, cscript, certutil, bitsadmin) via AppLocker or WDAC for users who do not have a documented need. Lazarus leans on these heavily for staging and download cradles.
8. Enforce EDR in block mode everywhere — including servers and VDI. Nation-state implants routinely exploit coverage gaps in "server-only" or audit-mode segments of the estate.

When the Patch Drops

9. Establish an emergency patch lane now. When Microsoft assigns a CVE and ships the fix, this will be an emergency-change candidate: pre-stage your test ring, pre-approve the change record, and define your deployment SLA (24–72 hours for a confirmed in-the-wild zero-day is the right bar).
10. Post-patch, hunt back. Zero-day patches close the door going forward — they do nothing about intrusions that already occurred. After patching, run retrospective hunts over the full pre-patch telemetry window for the behaviors in this post.

Strategic

11. Assume persona-level targeting of your people, not just your network. Operation Dream Job targets employees on personal email and social platforms outside your perimeter. Extend awareness training to cover personal-device and personal-inbox risk for sensitive roles, and consider threat-informed tabletop exercises for this exact scenario.
12. Feed the behaviors into your detection engineering backlog permanently. The lure themes change; the LOLBin staging, signed-binary side-loading, and masqueraded persistence do not. These rules will outlive this campaign.

Closing Assessment

Operation Dream Job has been running since at least 2019, and Lazarus keeps returning to it for one reason: it works. A well-crafted job offer hits the exact psychological pressure point — career ambition — that no technical control fully governs. Pairing that lure with an unpatched Windows vulnerability raises the stakes considerably: the margin for user error is gone, and detection now rests entirely on behavioral telemetry and disciplined hunting.

The good news is that Lazarus's post-exploitation tradecraft is well-documented and highly observable. Lure processes spawning LOLBins, loaders staging from user-writable paths, and persistence hiding behind plausible names — these are patterns your SOC can catch today, with the rules and queries above, without waiting for a patch. Deploy the controls, run the hunts, and brief your people. The recruiter emailing your senior propulsion engineer is probably not from Lockheed Martin.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub