{"id":735347,"date":"2026-08-12T06:32:09","date_gmt":"2026-08-12T06:32:09","guid":{"rendered":"https:\/\/www.newsbeep.com\/uk\/735347\/"},"modified":"2026-08-12T06:32:09","modified_gmt":"2026-08-12T06:32:09","slug":"421-bugs-in-microsofts-patch-tuesday-release-and-the-norks-have-already-attacked-one","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/uk\/735347\/","title":{"rendered":"421 bugs in Microsoft’s Patch Tuesday release, and the Norks have already attacked one"},"content":{"rendered":"

This is an epic month for Microsoft patches, though not a record-setting one. Redmond addressed 421 bugs<\/a> in its own products this month – about 200 fewer CVEs than last month<\/a>, but likely the new norm<\/a>\u00a0with AI-assisted vulnerability disclosures and fixes<\/a>.\u00a0<\/p>\n

The big news is that North Korea\u2019s Lazarus Group (and possibly other miscreants) found and attacked one of these flaws as a zero-day in early June.<\/p>\n

The bug, tracked as CVE-2026-68820<\/a>, is a use-after-free in the Windows Ancillary Function Driver for WinSock. \u201cA locally authenticated attacker could run a specially crafted application on an affected system to trigger a race condition,\u201d Redmond warned, adding that successful exploitation could allow an attacker to execute code with SYSTEM-level privileges, and with no user interaction required.<\/p>\n

Microsoft credited Check Point researchers Moshe Marelus and David Driker with finding and reporting CVE-2026-68820, and the security shop\u2019s threat intel lead told us that his analysts first observed attackers – namely North Korea\u2019s Lazarus Group<\/a> – battering this CVE at the beginning of June.<\/p>\n

\u201cWe are familiar with one successful implementation of the CVE – but we assume it was used widely in the campaign,\u201d Sergey Shykevich, director of threat intelligence at Check Point, told The Register.<\/p>\n

He\u2019s talking about Operation Dream Job<\/a>, a long-running campaign targeting organizations worldwide, especially those in the defense sector, and attributed to Lazarus, an umbrella term for Pyongyang’s government-sponsored goons who specialize in\u00a0cryptocurrency theft<\/a>, extortion attacks, and IT worker scams<\/a>.\u00a0<\/p>\n

It\u2019s probably best known for the Sony Pictures Entertainment hack<\/a> in late 2014 and the WannaCry ransomware outbreak<\/a> in 2017, although the group has been active since at least 2009.\u00a0<\/p>\n

Lazarus\u2019 DreamJob campaigns have been around since 2020<\/a>, and they use social engineering to lure job seekers with fake offers for high-profile positions, then trick the victims into clicking on malicious links or opening malware-laced documents. The goal in these attacks involves stealing IP and other sensitive data, conducting cyber spying missions, and collecting financial information.<\/p>\n

When Dream Job and Patch Tuesday collide<\/p>\n

This new wave of attacks focuses on the defense sector in Europe and India with dream jobs impersonating Lockheed Martin and privacy-tech firm Enveil. Attackers created at least three fake Enveil sites, and some even ranked as the top search result, making them even more believable to job seekers – and harder to spot a phish.\u00a0<\/p>\n

\u201cIn this campaign, the threat actor expanded its delivery method by leveraging impersonation websites and search engine optimization (SEO) techniques to distribute the trojanized applications, increasing its credibility and helping it evade some phishing-based detections,\u201d Check Point researchers said<\/a> in a Tuesday blog.<\/p>\n

These attacks involve Lazarus distributing a modified PDF viewer called SecurityPDF designed to execute malicious payloads embedded within attacker-crafted PDF files when the user opens them. The PDFs, when opened, execute a never-before-seen backdoor that Check Point named Troy.<\/p>\n

And during the intrusions, the Norks exploited CVE-2026-68820 as a zero-day to deploy a new version of FudModule, Lazarus\u2019 kernel-mode rootkit.\u00a0<\/p>\n

\u201cWe will not be disclosing full technical details of the vulnerability in this article, as it was patched on the August 11 Patch Tuesday fix,\u201d the researchers wrote. \u201cAt a high level, the exploit takes advantage of how afd.sys handles a socket is created when it is accessed concurrently by several threads at once.\u201d<\/p>\n

Shykevich told us that \u201cthis campaign shows that this actor continues to develop new tools (like Troy), and finding and implementing new vulnerabilities in Windows to evade detection.\u201d<\/p>\n

Best of the rest<\/p>\n

Redmond lists one of the other 421 Microsoft CVEs as publicly known. It\u2019s CVE-2026-62832<\/a>, an elevation-of-privilege flaw, and the Windows giant says exploitation is \u201cmore likely,\u201d so patch this one sooner.<\/p>\n

\u201cAn authenticated attacker who has credentials for another local account could run a specially crafted application to load another user’s registry hive,\u201d according to the security advisory. \u201cSuccessful exploitation could allow the attacker to access or modify another user’s data and gain administrator privileges. User interaction is not required.\u201d<\/p>\n

While CVE-2026-68820 and CVE-2026-62832 are the only vulnerabilities that Microsoft considers \u201cnotable\u201d in its August patch cycle, Trend Micro\u2019s Zero Day Initiative highlights five others<\/a>, including one that came through ZDI\u2019s bug reporting program and another that was successfully exploited at ZDI\u2019s Pwn2Own contest in Berlin. All five of these should be considered notable and exploitable, so give those a read, too.<\/p>\n

CVE-2026-6289<\/a>3<\/a>, a critical flaw in Windows Deployment Services TFTP Server that leads to remote code execution without user authentication or user interaction, is the one disclosed through ZDI. \u201cTFTP has no auth mechanism and is available remotely vid UDP port 69,\u201d ZDI bug boss Dustin Childs wrote. \u201cUDP port 69 should be blocked at your perimeter, but this could easily be used by attackers for lateral movement within an enterprise. Again, test and deploy this one quickly if you\u2019re using WDS for deployments in your enterprise.\u201d<\/p>\n

Meanwhile, CVE-2026-62911<\/a>, one of the many Exchange bugs in this month\u2019s release, was demonstrated at ZDI\u2019s Pwn2Own in Berlin. It allows a privilege escalation via an authentication bypass, and exploitation would allow an attacker to \u201ctake over the mailboxes of all Exchange users, attackers can send emails, read emails, download attachments,\u201d according to Microsoft, which oddly deemed \u201cexploitation less likely.\u201d<\/p>\n

Childs calls BS on this. \u201cIgnore Microsoft\u2019s exploitability and Exploit Code Maturity ratings,\u201d he wrote. <\/p>\n

\u201cWe handed them working exploits, so this is a real threat.\u201d \u00ae<\/p>\n","protected":false},"excerpt":{"rendered":"This is an epic month for Microsoft patches, though not a record-setting one. Redmond addressed 421 bugs in…\n","protected":false},"author":2,"featured_media":735348,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[59,86,56,54,55],"class_list":["post-735347","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-gb","tag-technology","tag-uk","tag-united-kingdom","tag-unitedkingdom"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/735347","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=735347"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/735347\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/735348"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=735347"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=735347"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=735347"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}