DEV Community

Anoymask
Anoymask

Posted on

Lazarus "Operation Dream Job": From Windows Zero-Day to EDR Bypass and Backdoor Deployment

#security #threatintel

Lazarus "Operation Dream Job": From Windows Zero-Day to EDR Bypass and Backdoor Deployment

1. Basic Information

2. Executive Summary

This is a multi-stage attack. It sends fake job offer PDFs to defense and aerospace personnel, uses DLL side-loading to launch MISTPEN, gains SYSTEM privileges and bypasses EDR using the Windows 11 kernel zero-day CVE-2026-68820, and finally deploys the ForestTiger backdoor.

3. Attack Flow

Chain A: From Job Document to Kernel Compromise

  1. The attacker sends fake job offers and interview invites to the target with an encrypted ZIP file.
  2. A signed PDF viewer inside the ZIP side-loads a malicious libmupdf.dll file.
  3. The DLL decrypts the payload (which is also an encrypted PDF), shows a decoy document, and runs MISTPEN in memory.
  4. MISTPEN uses Microsoft Graph API and OneDrive as C2 servers to fetch AES-encrypted tasks.
  5. It adds reconnaissance and persistence modules to collect host and environment information.
  6. An LPE loader exploits CVE-2026-68820 (afd.sys race condition / use-after-free) to get kernel read and write primitives.
  7. It loads FudModule to inject code into SYSTEM processes and modify security features, which reduces EDR visibility.
  8. It deploys the final-stage ForestTiger backdoor.

Chain B: Troy via Fake Websites

  1. The target is lured to a fake website or search result that mimics a legitimate company to download SecurityPDF and a crafted PDF.
  2. It extracts content using identification strings in the PDF, XOR-decrypts the executable, and saves it as %TEMP%\new.exe.
  3. It reflectively loads the Troy backdoor.
  4. Troy uses 17 types of commands for device and process recon, file sending and receiving, archiving, process termination, in-memory DLL injection, and beacon setting changes.

Chain C: Roundcube Relay Infrastructure

  1. It logs into Roundcube using credentials that are likely stolen.
  2. It exploits CVE-2025-49113, an authenticated PHP object deserialization vulnerability.
  3. It places the RelayShell web shell and uses at least 17 Roundcube servers as relays.
  4. It uses the compromised Roundcube and WordPress servers as C2 and traffic relays.

4. Attacker Position and Execution Locations

  • Initial delivery and C2 operations happen from attacker-controlled infrastructure, OneDrive, and compromised web servers.
  • DLL side-loading, MISTPEN, Troy, and the LPE loader run on the victim's Windows device.
  • CVE-2026-68820 and FudModule run in the Windows kernel and use SYSTEM privileges.
  • RelayShell runs on compromised Roundcube servers.

5. Visibility for Victims and Administrators

  • Users see a job offer PDF and a normal decoy document, so they do not notice any failure.
  • Administrators see a signed viewer load a non-standard DLL, followed by Graph and OneDrive network traffic.
  • After EDR is disabled, subsequent processes and file operations may disappear. Correlating Windows events, proxies, and cloud audits is important.

6. Success and Failure Conditions

Success Conditions

  • The target extracts the ZIP file and runs the included viewer.
  • The executable and malicious DLL exist in the same folder.
  • The target Windows 11 build has not patched CVE-2026-68820.
  • Network traffic to Microsoft Graph and OneDrive is allowed.
  • Security products do not block kernel driver operations or SYSTEM process injection.

Failure Conditions

  • Isolating attached or downloaded ZIP files, or blocking execution via Mark-of-the-Web and application control.
  • Detecting DLL search order abuse and blocking DLL loading from untrusted folders.
  • CVE-2026-68820 is patched, so LPE fails.
  • Blocking abnormal app and device traffic to the Graph API.
  • EDR self-defense, kernel integrity, and driver load controls block modifications.

7. What Happens on Success

Device reconnaissance, persistence, file operations, and C2 communication become possible, along with SYSTEM privilege escalation, reduced EDR visibility, and additional backdoor deployment. Defense and aerospace design data and credentials are targets, but public articles do not prove successful data theft on every target.

8. Observable Logs

  • Email: Job and hiring themes, encrypted ZIP files, external senders, and unknown recruiters.
  • Proxy/SWG/DNS: Fake company websites, non-business app traffic to Graph API and OneDrive, and periodic traffic to compromised Roundcube and WordPress servers.
  • Endpoint/EDR: Signed PDF viewer loading libmupdf.dll, in-memory MISTPEN and Troy, %TEMP%\new.exe, abnormal I/O targeting afd.sys, SYSTEM process injection, and modification of EDR services and callbacks.
  • Identity/IdP: Abnormal logins to Roundcube and use of stolen credentials. Whether Graph usage requires an organization ID depends on the configuration.
  • SaaS/Cloud: Suspicious object downloads on OneDrive, low-frequency periodic access to the Graph API, and unknown clients or apps.
  • Network: AES-encrypted beacons, relays via compromised web servers, and endpoint connections to Roundcube and WordPress servers that are unrelated to normal business.

9. Attack Success Determination

  • Contact Only: Receiving a job email or visiting a URL.
  • User Action: Extracting the ZIP file and opening the PDF viewer.
  • Initial Execution: Loading the malicious DLL and executing MISTPEN or Troy in memory.
  • Malware Success: Fetching C2 tasks, sending recon results, and creating persistence modules.
  • Privilege Compromise: Obtaining a SYSTEM token after CVE-2026-68820, loading FudModule, and injecting into a SYSTEM process.
  • Data Theft & Further Compromise: Creating archives and transferring them outward, continuous beacons from ForestTiger, or using additional stolen credentials.

10. Investigation Playbook

  • Trigger: PDF viewer abnormal DLL loading, suspected OneDrive C2, SYSTEM process injection, and sudden disappearance of EDR telemetry.
  • Initial Check: Preserve the hashes and sources of the email, ZIP, executable, DLL, and PDF, and determine the exact execution time.
  • Endpoint: Investigate Prefetch, Amcache, Shimcache, MFT, memory, driver and kernel events, %TEMP%, and persistence locations.
  • Auth & Cloud: Check Graph and OneDrive audits, OAuth apps, Roundcube authentication, and cross-account use of the same credentials.
  • Subsequent Actions: Search for ForestTiger, archives, internal recon, connections to additional hosts, and web shells or relays.
  • Containment: Isolate the endpoint, update Windows, revoke related accounts and tokens, block Graph paths, and isolate or rebuild compromised web servers.
  • Confidence Levels: Targeted / User Executed / Initial Payload Confirmed / Kernel LPE Confirmed / Defense Evasion Confirmed / Exfiltration Confirmed.

11. Defense and Detection Ideas

  • Single Event: PDF viewer loading libmupdf.dll from the same folder, creation of %TEMP%\new.exe, and unknown processes accessing the Graph API.
  • Timeline Correlation: Receiving a job ZIP -> launching the viewer -> loading the DLL -> OneDrive communication -> kernel anomaly -> missing EDR telemetry.
  • Hunting: Non-standard DLLs loaded by signed document viewers, non-browser processes using the Graph API, injection into SYSTEM processes, and new PHP files in Roundcube web roots.
  • Log Gaps: Missing DLL image loads, kernel I/O, Graph audits, EDR self-defense, and web server FIM make it hard to break the attack chain.
  • Priority Actions: Patch CVE-2026-68820, isolate attachments, use application control, monitor Graph, enable EDR self-defense, update Roundcube, and rotate credentials.

12. Facts / Inference / Hypothesis

Facts

  • Check Point confirmed active exploitation of CVE-2026-68820 in Operation Dream Job targeting defense and aerospace sectors.
  • MISTPEN used Microsoft Graph and OneDrive as its C2.
  • CVE-2026-68820 uses a race condition / use-after-free in afd.sys to move from kernel read/write to SYSTEM privileges.
  • FudModule and ForestTiger were used in later stages.
  • Troy has 17 remote control commands.

Inference

  • Missing logs after EDR modification may mean defense evasion rather than "no activity," so network, Windows, and cloud logs should be used to fill the gaps.
  • Global defense, heavy industry, and aerospace supply chains also match these job themes and engineering user profiles.

Hypothesis

  • Combining OneDrive object names, API call frequency, and parent processes can reduce false positives with legitimate OneDrive usage.

13. MITRE ATT&CK Mapping

  • High Confidence: T1566.001 Spearphishing Attachment, T1204.002 Malicious File, T1574.002 DLL Side-Loading, T1055 Process Injection, T1068 Exploitation for Privilege Escalation, T1562.001 Impair Defenses, T1105 Ingress Tool Transfer, T1071.001 Web Protocols, T1102.002 Web Service: Bidirectional Communication.
  • Medium Confidence: T1547 (persistence details depend on the module), T1560 Archive Collected Data, T1041 Exfiltration Over C2 Channel.

14. Unknowns and Further Investigation

  • Initial delivery paths, stolen data, and scope of compromise across all targets.
  • Details of the tenants and apps used for Graph and OneDrive C2.
  • Specific EDR features disabled by FudModule in each environment.
  • Mapping between RelayShell infrastructure and endpoint chains per target.

15. Impact on Global SOCs and Enterprises

In defense, heavy industry, aerospace, and advanced manufacturing sectors, contacts pretending to be overseas job offers or joint research look very natural. Organizations need to monitor not only Windows updates, but also DLL side-loading of signed apps, Microsoft 365 communication used for C2, and missing EDR telemetry as a single connected chain.

16. Summary by Target Audience

  • For SOCs: Correlate events in a timeline from the job ZIP to Graph communication, kernel LPE, and missing EDR logs. Do not evaluate OneDrive traffic in isolation.
  • For Admins: Apply the CVE-2026-68820 patch to Windows 11, and verify application control, Graph audits, and EDR self-defense.
  • For Users: Do not run encrypted ZIP files or custom PDF viewers from unknown recruiters. Verify job postings through official channels of legitimate companies.

Top comments (0)