Bottom line: Lazarus Group exploited a now-patched Windows zero-day to gain SYSTEM privileges via Operation Dream Job and install a new backdoor at defense and aerospace companies in France, Germany, Brazil and India.
According to Check Point Research, the North Korean group Lazarus exploited a since-patched Windows security vulnerability as a zero-day to plant a previously unknown backdoor at defense and aerospace companies. Organizations in France, Germany, Brazil and India were affected.
Check Point Research attributes the attacks to the “Operation Dream Job” campaign, a cyberespionage operation run by the Lazarus Group that has been active for years. The attackers exploited a previously unknown vulnerability in Microsoft Windows to obtain SYSTEM privileges, and subsequently deployed a previously undocumented backdoor. According to the report, the vulnerability has since been closed by Microsoft. The original report provides no further details on specifics such as a concrete CVE ID, the patch date, or the affected Windows version.
The campaign’s target industry is defense and aerospace companies in four countries: France, Germany, Brazil and India. Operation Dream Job has long been known for social engineering approaches in which victims are lured into executing malicious code via fake job offers or recruiting contacts. The combination of zero-day exploitation and a new backdoor points to a further development of the group’s technical capabilities.
For CISOs in the defense, aerospace and adjacent supplier industries, immediate action is required: Windows systems should be checked promptly for the current patch status as soon as Microsoft provides or has provided the corresponding updates. Since SYSTEM privileges are at the center of the exploitation, privilege escalation detection and monitoring of unusual process activity with elevated privileges should be reviewed as a priority. Given the connection to Operation Dream Job, it is also advisable to raise awareness among employees with recruiting or job application contact regarding social engineering attempts via LinkedIn or similar channels.
The incident once again underscores the sustained interest of state-linked North Korean actors in Western and allied defense supply chains. Security teams in the target countries mentioned should incorporate the indicators from the Check Point report into their threat intelligence feeds and retrospectively examine relevant systems for signs of compromise.
Source: thehackernews.com · Published August 12, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.