Good news: if you were hoping an email offering an irresistible job at a defense contractor was legit, it probably isn’t. North Korea–linked Lazarus Group has been using a freshly patched Windows kernel flaw (the AFD.sys issue patched in August 2026) to escalate privileges and drop a new backdoor on victims across several countries. In plain speak: they get SYSTEM, and they don’t leave politely.

What happened

The attackers lure targets with fake recruiter messages promising dream roles, then trick them into opening malicious PDFs or installing a poisoned PDF viewer. Once the bait is taken, the chain splits two ways: a DLL side‑loading route that launches a tiny downloader, or a trojanized PDF reader that wakes up an in-memory backdoor. All roads lead to remote access and data theft.

At the center of this mess is an exploit that grants elevated privileges in Windows. By abusing a zero-day privilege escalation in the kernel driver, the intruders push a kernel-mode rootkit and elevate a downloader so it runs as SYSTEM — invisible to many security tools — and then install the final payloads.

  • DLL side-loading: Victims unpack an encrypted archive which triggers a malicious DLL masquerading as a legitimate component. That DLL displays a fake job listing while quietly fetching and running a downloader that talks to cloud services to pull additional modules.
  • Trojanized PDF viewer: A fake “SecurityPDF” application pretends to show a protected document. If the PDF contains a special marker, the reader decrypts and launches an embedded payload that lands a memory-only backdoor with numerous remote commands.

The downloader (nicknamed MISTPEN in the reports) then loads several modules to profile the host, collect process lists, take screenshots, and prepare an LPE loader that negotiates post‑quantum keys and decrypts further components. The final implants include a backdoor (referred to as Troy) and an updated kernel rootkit (FudModule 3.1) that can tamper with Windows features meant to stop dodgy apps from running.

  • GetInfoPlugin — host profiling and info exfiltration
  • PvPlugin — process and reconnaissance data collection
  • OneScreenCapture — full-desktop screenshots sent as images
  • LPE loader — gathers host info and runs privileged components

How the campaign works (and what you can do about it)

Instead of building a suspicious infrastructure from scratch, the operators leaned on hacked-but-legitimate websites — WordPress, SharePoint and vulnerable webmail servers — to hide command-and-control traffic. They also spun up convincing vendor-lookalike pages to host that poisoned PDF viewer. That cocktail of social engineering plus borrowed trust makes detection a real headache.

If you run systems or train people, here’s a practical (and slightly paranoid) checklist to reduce your odds of being next:

  • Patch quickly: install the Windows updates that fix the AFD.sys vulnerability and any webserver or app patches offered by vendors.
  • Don’t install unknown PDF viewers — especially if a recruiter insists it’s required to view a file.
  • Verify software from official vendor sites or your internal software portal rather than trusting search results or emailed links.
  • Harden and monitor web apps: check WordPress, SharePoint and Roundcube instances for compromise and known vulnerabilities, and tighten upload/exec controls.
  • Enable/work toward zero-trust: assume even “trusted” sites can be compromised and restrict lateral movement and privileged elevations.
  • Watch for suspicious behavior: unexpected msiexec children running unusual network calls, in-memory DLL activity, or processes trying to flip code-integrity settings.
  • Train staff to be skeptical of recruiter messages that push unusual workflows or external installers.

Short version: the attack mixes old-school social engineering with some shiny new kernel tricks, and it’s tailor-made to fool both people and automated checks. Keep systems patched, be picky about what you install, and remember: if a recruiter begs you to install a special viewer, treat it like a red flag waving a tiny, furious flagpole.