CVE-2026-68820 WinSock Zero-Day: Lazarus Deploys Rootkit
The CVE-2026-68820 WinSock zero-day was already being used by North Korea’s Lazarus Group to plant a kernel-mode rootkit weeks before Microsoft shipped a fix in its August 2026 Patch Tuesday. Any Windows endpoint that processes network sockets — which is to say, essentially every Windows machine on your network — was exposed until this month’s cumulative update was applied.
What Happened
Microsoft’s August 2026 Patch Tuesday closed 398 CVEs (some third-party trackers report 421 due to differing CNA-inclusion methodology — the discrepancy is a counting convention, not a factual dispute). The most serious entry is CVE-2026-68820, a use-after-free vulnerability in the Ancillary Function Driver for WinSock (afd.sys), the kernel-mode component that underlies nearly all Windows Sockets API operations. A locally authenticated attacker who triggers the flaw can escalate privileges to SYSTEM level, gaining near-total control of the endpoint.
Check Point responsibly disclosed the CVE-2026-68820 WinSock zero-day to Microsoft shortly before the patch shipped, and confirmed that Lazarus Group had already been exploiting it in the wild to deploy FudModule, its signature kernel-mode rootkit. The activity is part of a fresh wave of “Operation Dream Job,” a long-running Lazarus espionage campaign that uses fake job-recruitment offers to lure targets in the defense and aerospace sectors, with confirmed activity in Europe, India and Brazil. This is the fourth afd.sys zero-day exploited in the wild since 2022, following CVE-2025-32709, CVE-2025-21418, and CVE-2024-38193 — the last of which was also attributed to Lazarus.
The same release patches two other notable flaws: CVE-2026-62815 (CVSS 9.8), an unauthenticated remote code execution vulnerability in Microsoft QUIC triggered by a single crafted network packet with no user interaction, and CVE-2026-63520, a SharePoint RCE that becomes unauthenticated when chained with a previously patched flaw — the fifth SharePoint vulnerability DIESEC has tracked since early July. A Windows kernel elevation-of-privilege bug, CVE-2026-62737, was publicly disclosed with a working crash proof-of-concept before Microsoft’s patch was available.
Why It Matters
Afd.sys sits underneath almost every network-facing Windows process, so a working exploit chain for it is valuable regardless of what else is running on the box — and Lazarus has now demonstrated exactly that value four times in four years. For DACH manufacturing, defense-adjacent and aerospace-supply-chain organizations specifically, “Operation Dream Job” is not a generic phishing risk: it is a targeted campaign built around fake recruiting outreach to employees with technical access, and it ends in kernel-level rootkit persistence that most endpoint tooling is not designed to catch after the fact.
What You Should Do Now
- Deploy the August 2026 cumulative update to all Windows 10, 11 and Windows Server builds immediately — CVE-2026-68820 has confirmed nation-state exploitation, not just theoretical risk.
- Check whether your endpoint detection tooling has kernel-mode rootkit detection capability (FudModule specifically abuses BYOVD-style techniques); if you rely solely on signature-based AV, treat this as a coverage gap to close separately from patching.
- If no immediate patch window exists, restrict local logon rights on exposed endpoints, since CVE-2026-68820 requires local authentication to trigger — reducing who can log in locally reduces the exploitable population.
- Brief HR and technical staff involved in recruiting or job applications on the “Operation Dream Job” pattern (fake recruiter contact leading to a malicious attachment or link) — this is a social-engineering entry point, not just a technical one.
DIESEC Perspective
The pattern here is not “Microsoft had a bad patch month” — it’s a fourth confirmed exploitation of the same driver class by the same actor group over four years. That is a signal that afd.sys-class kernel components deserve their own place in a DACH organization’s threat model, independent of whatever else that month’s Patch Tuesday contains.
Not sure whether your endpoint fleet has kernel-level rootkit detection or is relying on patch cadence alone? Contact DIESEC for a rapid endpoint exposure and detection-coverage review.
Sources: SecurityWeek | The Hacker News
Published: 2026-08-13 | Category: Vulnerabilities & Patches | ~4 min read
