Federal agencies were ordered to patch a Windows vulnerability used by North Korean hackers to target people applying to jobs in the defense and aerospace industry.\u00a0 <\/p>\n
The Cybersecurity and Infrastructure Security Agency (CISA) and Microsoft confirmed<\/a> on Tuesday that CVE-2026-68820 is being exploited. The bug was the only vulnerability in Microsoft\u2019s Patch Tuesday release<\/a> that the company confirmed is being used in real-world attacks.\u00a0 <\/p>\n The vulnerability impacts Winsock, a tool that acts as a bridge allowing web browsers to connect to the internet.\u00a0 <\/p>\n Nightwing’s Nick Carroll compared the bug, which carries a seven out of ten severity score, to an intruder slipping through a closing door to print their own all-access VIP badge for a secure facility. <\/p>\n CISA gave federal agencies until August 25 to patch the bug. A device restart is required and there is no workaround to the issue. Automox CTO Jason Kikta noted that the same component was previously exploited in 2024 by the Lazarus Group, an infamous hacking operation run out of North Korea\u2019s Reconnaissance General Bureau.\u00a0 <\/p>\n Kikta said the vulnerability requires two steps: an attacker would need to phish their way into a low-privileged foothold before using it.\u00a0 <\/p>\n \u201cTreat this as the month’s deadline item. It’s the one confirmed-exploited bug in the release, and it applies to every Windows endpoint you manage. Put the noise to work. This exploitation pattern is detectable, but only if your detection actually covers kernel-driver race abuse,\u201d Kikta added.\u00a0 <\/p>\n Operation \u2018Dream Job\u2019<\/p>\n Check Point said it disclosed the bug to Microsoft after discovering it as part of its examination into the latest wave of attacks that are part of Operation \u2018Dream Job\u2019<\/a> \u2014 a long-running campaign by North Korean hackers to exploit the job application process.\u00a0 <\/p>\n A Check Point report released<\/a> on Tuesday said Lazarus Group hackers impersonated recruiters for Lockheed Martin and privacy-tech firm Enveil, contacting people on LinkedIn and other sites before sending candidates malicious PDF files. Once the files are opened, a backdoor is enabled that provides Lazarus hackers with long term remote access.\u00a0 <\/p>\n Check Point researchers explained that the malware first gathers information about the infected device before deploying an exploit for CVE-2026-68820.\u00a0 <\/p>\n They initially thought the issue was related to a past vulnerability fixed last year but further testing proved it was a new bug. The flaw \u201callows an attacker who has already gotten malware onto a machine to escalate from limited access to complete control of it, the kind of control normally reserved for the operating system itself.\u201d <\/p>\n Sergey Shykevich, director of threat intelligence at Check Point, said what made the campaign dangerous is not just the zero-day vulnerability but Lazarus\u2019 ability to weave legitimate, trusted infrastructure into every stage of the attack.\u00a0 <\/p>\n \u201cThey hid in plain sight, behind top-ranked search results, real vendor branding, and the reputation of organizations they had already compromised,\u201d he said. \u201cWhen the website, the download and the recruiter all appear authentic, the old advice to ‘spot the phishing link’ is no longer easily applicable.\u201d <\/p>\n The researchers found targets spanning several defense sectors \u2014 including surveillance sensors, drones and robotics \u2014 in France, Germany, Brazil and India.\u00a0 <\/p>\n Threat researchers at several companies have been tracking<\/a> the Operation DreamJob campaign since 2020. Google warned in 2022<\/a> that 250 people working for 10 different news media, domain registrars, web hosting providers and software vendors were targeted by the campaign, receiving malicious emails from fake recruiters claiming to be from Disney, Google and Oracle.\u00a0 <\/p>\n ESET previously tracked<\/a> compromises related to the campaign in India, Poland, the U.K. and most recently Italy.\u00a0 <\/p>\n CISA\u2019s decision to order federal agencies to patch the bug comes after FBI officials said<\/a> they are currently investigating an incident where an unidentified federal agency mistakenly hired an IT worker from North Korea as part of the country\u2019s long-running campaign<\/a> to infiltrate organizations globally. <\/p>\n Get more insights with the <\/p>\n Recorded Future<\/p>\n Intelligence Cloud.<\/p>\n