Bottom line: The North Korean Lazarus Group is exploiting the Windows zero-day vulnerability CVE-2026-68820 as part of the Operation Dream Job campaign to target defense contractors.
North Korean hackers from the Lazarus Group have exploited a previously unknown Windows vulnerability (CVE-2026-68820) to specifically target defense industry companies as part of the “Operation Dream Job” campaign.
Security researchers have determined that the attacker group known as Lazarus, linked to North Korea, is actively exploiting a zero-day vulnerability in Windows tracked as CVE-2026-68820. The attacks are targeting companies in the defense sector. Researchers are tracking the campaign under the name “Operation Dream Job”, a long-known Lazarus operation that typically uses fake job offers as an entry vector to lure targets into executing malicious files.
For CISOs in the defense and armaments industry, this creates an immediate risk: a zero-day vulnerability means that no official patch from Microsoft was available at the time of exploitation, and classic signature-based protection mechanisms could not reliably detect the attacks. Since the Lazarus Group has historically targeted espionage and the theft of intellectual property as well as sensitive defense data, this should be regarded as a targeted, long-term threat that circumvents classic perimeter protection measures.
Affected organizations should check whether and when Microsoft releases a security patch for CVE-2026-68820, and apply it with high priority. Until then, increased monitoring of systems related to the defense sector is recommended, particularly with regard to suspicious activity connected to job application or job offer emails, which serve as the typical entry point for Operation Dream Job. Awareness training for employees with access to sensitive defense data should address the specific social engineering tactics used in this campaign.
Source: www.bleepingcomputer.com · Published August 12, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.