Windows afd.sys Zero-Day CVE-2026-68820 Exploited via DLL Sideloading in Targeted Campaigns
A patched Windows zero-day in afd.sys was chained with DLL sideloading and two novel backdoors in campaigns against defense firms. Check Point provided the primary IOC set while CISA confirmed active exploitation. The activity continues established lure patterns but attribution rests on malware reuse rather than independent state linkage.
Attackers delivered archives containing a PDF viewer, malicious DLL, and encrypted payload through professional networking platforms and messaging apps. Victims opened the decoy while the sideloaded DLL executed the downloader, performed reconnaissance, established persistence, and triggered the afd.sys flaw. A parallel chain used the trojanized SecurityPDF viewer to activate the Troy implant directly in memory upon detecting a hidden marker in opened PDFs.
Microsoft issued the patch on August 11 as part of Patch Tuesday; CISA added CVE-2026-68820 to the KEV catalog with a 14-day federal deadline. Technical indicators include the specific race condition in the Ancillary Function Driver for WinSock and command sets in Troy supporting 17 operator functions. C2 infrastructure relied on compromised Roundcube instances vulnerable to CVE-2025-49113 running the undocumented RelayShell PHP relay.
The campaign extends prior Operation Dream Job activity against aerospace and defense entities in Europe and India. Malware overlaps with previously reported Lazarus tools exist, yet independent technical attribution confirming state direction remains limited to code similarity and infrastructure patterns rather than direct evidence. Procurement records and prior incidents show repeated use of job-themed lures against the same sectors.
Targeted organizations should deploy the August updates immediately, audit unsolicited recruiting contacts, and monitor for afd.sys-related anomalies plus RelayShell file artifacts on web servers. Similar zero-day chains are likely to reappear before broader patch adoption.
CISA: Federal agency patch compliance for CVE-2026-68820 exceeds 75% by 25 August 2026
Sources (2)
- [1]Primary Source(https://www.securityweek.com/fresh-windows-zero-day-exploited-in-north-korean-cyberattacks/)
- [2]Supporting Source(https://www.cisa.gov/known-exploited-vulnerabilities-catalog)