Check Point Research has attributed a fresh Lazarus Group campaign — conducted under the long-running Operation Dream Job umbrella — to the exploitation of a previously unpatched Microsoft Windows vulnerability. The flaw, which has since been patched, allowed the North Korean state-sponsored actor to escalate privileges to SYSTEM and deploy a never-before-seen rootkit/backdoor against defense and aerospace organizations in France, Germany, Brazil, and India.
This is not a spray-and-pray operation. Operation Dream Job is a precision social-engineering and intrusion campaign that has been running for years, using fake job offers from recruiters at well-known defense contractors to lure engineers and technical staff into executing trojanized applications. The addition of a zero-day privilege escalation and a purpose-built stealth mechanism significantly raises the stakes: once the initial payload lands, the attackers can neutralize endpoint visibility and persist inside the operating system kernel or deep system components.
If your organization operates in defense, aerospace, or adjacent supply chains — or if you employ staff who are plausible recruitment targets — treat this as an active, elevated threat. The vulnerability is patched, but unpatched endpoints remain exploitable, and the rootkit's anti-forensic capabilities mean infections can persist undetected.
Technical Analysis
Threat Actor and Campaign Context
Lazarus Group (tracked variously as Diamond Sleet, TEMP.Hermit, and linked to sub-clusters such as Andariel) is a North Korean state-aligned threat actor with a documented history of financial theft, espionage, and destructive attacks. Operation Dream Job is their signature social-engineering campaign: targets receive tailored outreach via LinkedIn, email, or messaging platforms from personas posing as recruiters offering lucrative positions at defense and aerospace firms. The 'job offer' workflow eventually delivers a malicious payload — historically trojanized PDF readers, VPN clients, or document viewers weaponized with embedded malware.
Affected Platform
- Microsoft Windows — the exploited component is a Windows elevation-of-privilege flaw that was a zero-day at the time of exploitation and has since been patched by Microsoft.
- The campaign targets endpoints belonging to employees at defense and aerospace companies, meaning standard corporate Windows builds (Windows 10/11 and Windows Server) are in scope.
Attack Chain (Defender's View)
Based on Check Point Research's reporting, the intrusion chain follows this pattern:
- Initial access via social engineering — Target receives a fabricated job offer (Operation Dream Job). The lure leads to delivery of a trojanized application or malicious document, typically executed from user-writable paths such as
%TEMP%,%APPDATA%, or%USERPROFILE%\Downloads. - Staging and payload execution — The first-stage loader commonly abuses signed Windows binaries (rundll32.exe, mshta.exe, regsvr32.exe) or trojanized legitimate software to execute the implant while blending into normal process activity.
- Privilege escalation via the Windows zero-day — The attackers exploit the unpatched Windows vulnerability to escalate from standard user context to NT AUTHORITY\SYSTEM. This is the critical pivot point: it converts a user-context intrusion into full machine control.
- Deployment of a never-before-seen unauthorized access mechanism — A custom rootkit/backdoor is installed to provide covert persistence. Lazarus has previously demonstrated BYOVD (Bring Your Own Vulnerable Driver) tradecraft with its FudModule rootkit, loading legitimate-but-vulnerable signed drivers to gain kernel access and disable security tooling. Defenders should assume the new implant pursues similar objectives: blinding EDR/telemetry callbacks, hiding processes/files/registry artifacts, and maintaining long-term covert access.
- Espionage objectives — Collection of sensitive defense and aerospace intellectual property, credentials, and internal communications.
Exploitation Status
- Confirmed in-the-wild exploitation by a nation-state actor against named verticals and geographies.
- The vulnerability was exploited as a zero-day before a patch was available. The patch is now released, which means exploit details and potentially weaponized derivatives may proliferate to other actors — patch latency is now the dominant risk factor.
- Defenders should monitor the CISA Known Exploited Vulnerabilities (KEV) catalog for formal listing and any associated federal remediation deadlines.
Detection & Response
The detections below focus on the behaviors Lazarus must exhibit regardless of which specific loader or rootkit variant is deployed: LOLBin abuse from user-writable paths, script interpreters spawned by document readers, and suspicious driver/service installation consistent with rootkit deployment.
---
title: Operation Dream Job - LOLBin Execution From User-Writable Paths
id: 3f7a9c21-8b4e-4d5a-9f2c-1e6b0a3d5c7e
status: experimental
description: Detects rundll32, mshta, or regsvr32 executing payloads from user-writable directories, consistent with Lazarus Operation Dream Job first-stage loaders delivered via trojanized job-offer lures.
references:
- https://thehackernews.com/2026/08/lazarus-exploits-windows-zero-day-to.html
- https://attack.mitre.org/techniques/T1218/
author: Security Arsenal
date: 2026/08/18
tags:
- attack.execution
- attack.defense_evasion
- attack.t1218.011
- attack.t1218.010
logsource:
category: process_creation
product: windows
detection:
selection_lolbin:
Image|endswith:
- '\rundll32.exe'
- '\mshta.exe'
- '\regsvr32.exe'
selection_path:
CommandLine|contains:
- '\AppData\Local\Temp\'
- '\AppData\Roaming\'
- '\Users\Public\'
- '\Downloads\'
- '\ProgramData\'
filter_signed_dll:
CommandLine|contains:
- '\AppData\Roaming\Microsoft\'
condition: selection_lolbin and selection_path and not filter_signed_dll
falsepositives:
- Legitimate installers staging DLLs in user directories during software deployment
level: high
---
title: Suspicious Kernel Driver Load From Non-Standard Path (Rootkit / BYOVD)
id: 8c2e5b17-6d3a-4f9c-b1e4-7a0d2c8f5e3b
status: experimental
description: Detects kernel driver loads from user-writable or non-standard locations, consistent with Lazarus rootkit deployment and BYOVD tradecraft (e.g., FudModule) used to blind endpoint security tooling after SYSTEM-level compromise.
references:
- https://thehackernews.com/2026/08/lazarus-exploits-windows-zero-day-to.html
- https://attack.mitre.org/techniques/T1068/
- https://attack.mitre.org/techniques/T1014/
author: Security Arsenal
date: 2026/08/18
tags:
- attack.privilege_escalation
- attack.t1068
- attack.t1014
- attack.defense_evasion
logsource:
category: driver_load
product: windows
detection:
selection:
ImageLoaded|contains:
- '\AppData\'
- '\Users\Public\'
- '\ProgramData\'
- '\Temp\'
- '$Recycle.Bin'
filter_system:
ImageLoaded|contains: '\Windows\System32\drivers\'
condition: selection and not filter_system
falsepositives:
- Rare; legitimate drivers load from System32\drivers or driver store. Investigate every hit.
level: critical
---
title: Document Reader or Trojanized Viewer Spawning Script Interpreter
id: 5d1f8a42-3c7b-4e6d-a2f9-9b4c1e7d0a6f
status: experimental
description: Detects PDF readers, document viewers, or trojanized applications spawning command shells or script interpreters, matching Operation Dream Job lure execution behavior where a malicious document or weaponized viewer launches the first-stage payload.
references:
- https://thehackernews.com/2026/08/lazarus-exploits-windows-zero-day-to.html
- https://attack.mitre.org/techniques/T1204.002/
author: Security Arsenal
date: 2026/08/18
tags:
- attack.execution
- attack.t1204.002
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\AcroRd32.exe'
- '\Acrobat.exe'
- '\SumatraPDF.exe'
- '\FoxitPDFReader.exe'
- '\WINWORD.EXE'
- '\EXCEL.EXE'
- '\POWERPNT.EXE'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\rundll32.exe'
condition: selection_parent and selection_child
falsepositives:
- Some enterprise document workflows legitimately invoke scripts; baseline before deploying widely
level: high
KQL — Microsoft Sentinel / Defender
This hunt looks for the privilege-escalation pivot and rootkit staging: suspicious services and driver installs from non-standard paths, plus LOLBin execution from user directories. Run both queries and correlate on DeviceName and time window.
// Hunt 1: Suspicious service/driver installation from non-standard paths (rootkit staging)
let lookback = 14d;
let SuspiciousPaths = dynamic([@"\AppData\", @"\Users\Public\", @"\ProgramData\", @"\Temp\"]);
union (
SecurityEvent
| where TimeGenerated > ago(lookback)
| where EventID == 7045 // New service installed
| extend ServicePath = tostring(parse_csv(EventData)[4])
), (
DeviceEvents
| where TimeGenerated > ago(lookback)
| where ActionType == "ServiceInstalled"
| extend ServicePath = AdditionalFields
)
| where ServicePath has_any (SuspiciousPaths)
or ServicePath has ".sys"
| project TimeGenerated, DeviceName, AccountName, ServiceName, ServicePath
| order by TimeGenerated desc;
// Hunt 2: LOLBin execution from user-writable paths (Operation Dream Job loader behavior)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("rundll32.exe", "mshta.exe", "regsvr32.exe", "wscript.exe", "cscript.exe")
| where ProcessCommandLine has_any ("AppData\\Local\\Temp", "AppData\\Roaming", "Users\\Public", "\\Downloads\\")
| where InitiatingProcessFileName !in~ ("msiexec.exe", "sccm", "intune")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc
Velociraptor VQL
Use this artifact for triage on hosts where the privilege-escalation or rootkit behaviors fired. It enumerates processes running from user-writable paths and recently created driver files outside the standard driver store.
-- Lazarus Operation Dream Job triage: suspicious processes and rogue drivers
-- Section 1: Processes executing from user-writable or anomalous paths
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(AppData|Users\\Public|ProgramData|Temp)'
OR CommandLine =~ '(?i)(rundll32|mshta|regsvr32).*(AppData|Temp|Public)'
-- Section 2: Kernel drivers created in the last 14 days outside System32\drivers
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['C:/Users/**/*.sys', 'C:/ProgramData/**/*.sys', 'C:/Windows/Temp/**/*.sys'])
WHERE Mtime > (now() - 1209600)
ORDER BY Mtime DESC
Remediation and Verification Script
Run the following PowerShell on endpoints (or deploy via your RMM/Intune) to verify patch status, enumerate suspicious drivers and services consistent with rootkit staging, and confirm the Microsoft Vulnerable Driver Blocklist is enforced.
# Lazarus Operation Dream Job - Endpoint verification and hardening checks
# Run as Administrator. Outputs findings to console and C:\IR-Triage\lazarus-check.txt
$out = "C:\IR-Triage"
New-Item -Path $out -ItemType Directory -Force | Out-Null
$log = "$out\lazarus-check.txt"
"=== Triage started: $(Get-Date) ===" | Out-File $log
# 1. Confirm recent cumulative updates are installed (patched state)
"--- Installed hotfixes (last 60 days) ---" | Out-File $log -Append
Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-60) } |
Sort-Object InstalledOn -Descending |
Format-Table HotFixID, Description, InstalledOn -AutoSize | Out-File $log -Append
# 2. Enumerate drivers NOT loading from System32\drivers (rootkit / BYOVD indicator)
"--- Drivers with non-standard image paths ---" | Out-File $log -Append
Get-CimInstance Win32_SystemDriver | Where-Object {
$_.PathName -and $_.PathName -notmatch 'system32\\drivers' -and $_.State -eq 'Running'
} | Select-Object Name, DisplayName, State, PathName | Format-List | Out-File $log -Append
# 3. Find recently created .sys files in user-writable locations
"--- Recent .sys files in user-writable paths ---" | Out-File $log -Append
Get-ChildItem -Path "$env:ProgramData","$env:PUBLIC","$env:TEMP","$env:APPDATA" `
-Recurse -Filter *.sys -ErrorAction SilentlyContinue |
Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-30) } |
Select-Object FullName, CreationTime, Length | Format-List | Out-File $log -Append
# 4. Verify Microsoft Vulnerable Driver Blocklist is enforced (blocks BYOVD tooling)
"--- Vulnerable Driver Blocklist status ---" | Out-File $log -Append
$vdbl = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard -ErrorAction SilentlyContinue
if ($vdbl) {
"VulnerableDriverBlocklistEnabled: $($vdbl.VulnerableDriverBlocklistPresent)" | Out-File $log -Append
} else {
"Device Guard WMI class unavailable - check HVCI/Memory Integrity in Windows Security > Device Security" | Out-File $log -Append
}
# 5. List services pointing to executables in user-writable paths
"--- Services with suspicious binary paths ---" | Out-File $log -Append
Get-CimInstance Win32_Service | Where-Object {
$_.PathName -match 'AppData|Users\\Public|ProgramData|Temp'
} | Select-Object Name, State, StartMode, PathName | Format-List | Out-File $log -Append
Get-Content $log
Remediation
- Patch immediately. Apply the current Microsoft cumulative update containing the fix for the exploited Windows elevation-of-privilege flaw across all Windows 10/11 endpoints and Windows Servers. Prioritize internet-facing users, executives, engineers, and anyone in defense/aerospace program roles. Verify deployment with your patch-management platform — do not assume compliance.
- Enforce the Microsoft Vulnerable Driver Blocklist and HVCI/Memory Integrity. Lazarus rootkits rely on loading rogue or known-vulnerable drivers. Windows Defender Application Control (WDAC) with the vulnerable driver blocklist, plus Memory Integrity (HVCI), materially degrades BYOVD and kernel-rootkit tradecraft.
- Deploy Attack Surface Reduction (ASR) rules, particularly: block Office applications from creating child processes, block execution of potentially obfuscated scripts, and block process creations originating from PSExec/WMI. These directly disrupt the Dream Job lure-to-loader chain.
- Harden email and collaboration channels against recruitment-themed lures. Detonate attachments and linked archives in a sandbox; flag external outreach impersonating recruiters at major defense contractors. Conduct targeted awareness briefings for engineering staff — the lure only works because it is plausible.
- Hunt retrospectively. Run the KQL and VQL hunts above across at least a 30-day window. Any driver or service executing from a user-writable path on a corporate Windows endpoint is a finding — investigate as a potential compromise, not a tuning exercise.
- Assume kernel-level compromise requires rebuild. If the rootkit is confirmed on a host, standard AV remediation is insufficient. Isolate the host, capture memory and disk images for forensic analysis, rotate all credentials that touched the machine, and reimage from known-good media.
- Monitor the CISA KEV catalog for formal listing and any Binding Operational Directive deadlines, and track the Check Point Research publication for updated indicators of compromise as they are released.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.