Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
- ID
- 13638
- Status
- summarized
- Published
- 13 Aug 2026, 1:39 AM
- Fetched
- 13 Aug 2026, 3:59 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/lazarus-exploits-windows-zero-day-to.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.5
- Created
- 13 Aug 2026, 4:02 AM
- Tags
- Audience
- developerssaas_startup_founders
What happened
North Korea's Lazarus Group exploited CVE-2026-68820, a Windows AFD.sys privilege escalation flaw (CVSS 7.0) patched in August 2026 Patch Tuesday, to deploy a new backdoor called Troy against defense and aerospace companies in France, Germany, Brazil, and India. The campaign used fake LinkedIn recruiter messages and trojanized PDF viewers to deliver malware via DLL side-loading, with C2 communication through Microsoft Graph API and OneDrive.
Why it matters
If you or your team are in defense, aerospace, or adjacent industries and receive unsolicited recruiter outreach with PDF attachments on LinkedIn, treat it as a potential intrusion vector — the infection chain starts with opening a malicious PDF or installing a trojanized PDF viewer. For everyone else, this is a reminder that Microsoft Graph API and OneDrive are increasingly abused for malware C2, which may affect egress filtering decisions.
Discussion angle
The abuse of Microsoft Graph API and OneDrive for C2 traffic is worth discussing — it means traditional network egress monitoring may miss malicious activity hiding inside legitimate Microsoft 365 endpoints, which is relevant for anyone building or managing cloud-connected tooling.