Microsoft’s August 2026 Patch Tuesday closed out a Windows kernel zero-day that North Korea’s Lazarus group had already turned into a rootkit deployment vector. CVE-2026-68820, a use-after-free in afd.sys — the Ancillary Function Driver for WinSock — was used in the wild to gain SYSTEM privileges and load an upgraded build of Lazarus’s signature FudModule rootkit, as part of the group’s long-running Operation Dream Job espionage campaign against defense, aerospace, and aviation targets.

What happened

Check Point researchers Moshe Marelus and David Driker caught Lazarus operators exploiting an unpatched race condition in afd.sys to escalate from a low-privileged foothold to kernel-mode code execution. The flaw sits in how the driver handles a WinSock socket object when it’s accessed concurrently by multiple threads — a classic use-after-free that, won correctly, hands an attacker a stable SYSTEM-level primitive with no user interaction required beyond running a crafted local process. Check Point reported it responsibly, and Microsoft shipped a fix in the August 11 Patch Tuesday round, just days after disclosure — one of three zero-days patched in this month’s 421-CVE release.

The payload dropped after exploitation was FudModule v3.1, an updated build of the Bring-Your-Own-Vulnerable-Driver (BYOVD)-turned-native-kernel-exploit rootkit Lazarus has fielded since 2021. This version retains the toolkit’s core sabotage capability set: it strips ETW (Event Tracing for Windows) telemetry callbacks, disables registered minifilters, kills the NT Kernel Logger session, and blinds more than 90 individual ETW providers using a kill-list nearly identical to earlier FudModule generations. The net effect is a Windows box that keeps running normally while most kernel- and driver-level security telemetry silently stops reporting.

Technical details

  • CVE: CVE-2026-68820 — use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys)
  • CVSS: 7.0 (Important); local privilege escalation, race condition required, no user interaction
  • Affected: Windows Server 2019, Windows Server 2022, and Windows Server 2025 (including Server Core installations), alongside client Windows builds covered by the same August 2026 cumulative updates
  • Exploitation path: attacker needs an existing local, authenticated foothold; wins a race in concurrent socket handling to trigger the use-after-free and gain SYSTEM-level code execution in the kernel
  • Payload: FudModule v3.1 — kernel-mode rootkit disabling ETW telemetry, minifilters, and the NT Kernel Logger post-exploitation
  • Attribution: North Korea’s Lazarus group, as part of Operation Dream Job; confirmed campaign activity spans Europe, India, Brazil, and other regions targeting defense, aerospace, and aviation organizations
  • Fixed: Microsoft’s August 2026 Patch Tuesday (August 11), delivered via the standard monthly cumulative update channel

Impact

This isn’t a remote, unauthenticated bug — it needs a foothold first — but that’s exactly what makes it dangerous in the hands of an APT that specializes in getting footholds via fake recruiter outreach and trojanized job-application documents (Operation Dream Job’s signature initial-access technique). Once Lazarus has a user-level session on a target box, CVE-2026-68820 is the difference between a contained compromise and a fully rootkitted host where EDR and kernel logging have been selectively blinded. Defense, aerospace, and aviation contractors are the named targets, but the underlying driver bug affects any Windows Server 2019/2022/2025 host running unpatched — and FudModule’s telemetry-blinding behavior is reusable by any actor who can replicate the exploit chain once public writeups mature.

Mitigation

  • Apply the August 2026 cumulative update covering CVE-2026-68820 to all Windows Server 2019, 2022, and 2025 hosts (including Server Core) immediately — treat this as a Patch Tuesday priority, not a routine cycle item.
  • Hunt for FudModule indicators on hosts that can’t be patched immediately: gaps or abrupt termination in ETW provider output, a stopped NT Kernel Logger session, or minifilter driver unload events with no corresponding administrative action.
  • Review local-privilege-escalation exposure — this bug requires an existing foothold, so endpoint hardening against initial access (phishing, trojanized recruiter documents/job applications consistent with Operation Dream Job tradecraft) reduces the population of hosts where the kernel bug is reachable at all.
  • Flag anomalous concurrent socket activity or crash/restart patterns tied to afd.sys in EDR telemetry predating the patch, since race-condition exploitation attempts can produce transient instability before succeeding.
  • Assume elevated scrutiny is warranted for any defense, aerospace, or aviation-sector host that shows signs of compromise predating August 11, given the targeting pattern reported by Check Point.

Sources: The Hacker News — Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack, Cyber Security News — Windows AFD.sys 0-Day Actively Exploited by Lazarus Hackers to Deploy FudModule Rootkit, CSO Online — North Korea’s Lazarus deploys rootkit via zero-day flaw, BleepingComputer — Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days, The Register — 421 bugs in Microsoft’s Patch Tuesday release, and the Norks have already attacked one, Microsoft Security Update Guide — CVE-2026-68820.