Check Point Research has published a detailed look at a new wave of Operation Dream Job, the long-running Lazarus campaign that uses fake recruiting opportunities to compromise high-value targets. The latest activity is especially relevant for defense, aerospace, aviation, and government-contractor environments because it combines credible job lures with a trojanized PDF workflow, cloud-based command-and-control, compromised webmail infrastructure, and a patched Windows kernel zero-day.

The short version: this is not just another phishing story. It is a reminder that a single employee interacting with what appears to be a professional recruiting process can become the entry point for kernel-level malware designed to blind security tools and establish long-term access.

What Check Point Reported

According to Check Point, the newest Operation Dream Job activity focuses heavily on defense-sector organizations, including aerospace and aviation targets in Europe and India. The attackers used fake job opportunities and malicious document-handling workflows to move victims toward attacker-controlled payloads.

Two infection paths stand out:

  • DLL sideloading with a legitimate PDF viewer: victims were pushed to run a signed PDF viewer bundled with a malicious DLL and encrypted payload.
  • A trojanized PDF viewer called SecurityPDF: victims were instructed to use a modified viewer that decrypted and launched payloads from specially crafted PDF files.

Once running, the malware chain used MISTPEN as an in-memory downloader, communicating through Microsoft Graph API and OneDrive-hosted attacker files. Follow-on modules performed host reconnaissance, process collection, screenshot capture, persistence, privilege escalation, and backdoor deployment.

The most serious element is CVE-2026-68820, a Windows AFD.sys local privilege escalation vulnerability that Check Point says Lazarus exploited as a zero-day. Microsoft patched the issue in the August 11, 2026 Patch Tuesday release after responsible disclosure.

Why This Matters for SMBs and Government Contractors

Most small and mid-sized organizations will not be primary Lazarus targets. But government contractors, subcontractors, engineering firms, aviation suppliers, maritime suppliers, managed service providers, and professional-services firms supporting sensitive industries can sit close enough to the target to matter.

The campaign also abuses normal business behavior. Job conversations on LinkedIn, recruiter messages, PDF job descriptions, cloud file access, and document viewers are all familiar enough that users may not treat them like hostile infrastructure. That is exactly the point.

For smaller teams, the danger is not only the initial click. It is the attacker’s post-compromise design:

  • Cloud C2 can blend in with legitimate Microsoft 365 and OneDrive traffic.
  • Kernel-level privilege escalation can reduce endpoint visibility after initial execution.
  • Compromised Roundcube and WordPress servers can make infrastructure look more trustworthy than freshly registered attacker domains.
  • Recruiting lures bypass normal vendor-risk thinking because they target individuals rather than procurement channels.

Defensive Takeaways

1. Prioritize the August 2026 Windows patches

Patch Windows systems quickly, especially Windows 11 24H2 and 25H2 builds referenced in the reporting. CVE-2026-68820 was used in the wild, and delay gives attackers a working privilege-escalation path on already-compromised hosts.

2. Treat unsolicited recruiting files as executable risk

PDFs are not the only concern. The higher-risk behavior is downloading a custom viewer, helper utility, assessment tool, ZIP archive, or “secure document reader” from a recruiter-provided link. Security awareness training should explicitly cover recruiting workflows, not just invoices and password-reset lures.

3. Monitor for unusual Microsoft Graph and OneDrive patterns

Organizations using Microsoft 365 should baseline Graph API and OneDrive activity. Look for unusual client behavior, suspicious file access patterns, unexpected upload/download automation, and endpoint processes that should not be interacting with cloud storage APIs.

4. Watch for suspicious PDF-viewer child processes

PDF viewers spawning executables from temporary directories, loading unusual DLLs, or making unexpected network connections should be treated as high-signal detections. Application control can help by preventing unsigned or unknown binaries from running out of user-writable paths.

5. Harden exposed webmail and CMS infrastructure

Check Point observed attackers exploiting vulnerable Roundcube servers and using compromised web infrastructure as relay nodes. If your organization runs Roundcube, WordPress, or other public-facing platforms, keep them patched, restrict admin access, monitor file integrity, and investigate unexpected PHP files or abnormal outbound traffic.

Bulwark Black Assessment

This campaign is a good example of where modern intrusion tradecraft is headed: credible social engineering on the front end, cloud-native command-and-control in the middle, and kernel-level defense evasion on the back end. For government-adjacent businesses, the practical lesson is simple: do not build defenses only around malware signatures or obvious phishing domains. Build around behavior.

The controls that matter here are boring but powerful: fast patching, least privilege, application control, EDR visibility, Microsoft 365 logging, web infrastructure hygiene, and user training that covers real-world business workflows like recruiting. If a fake job offer can become a kernel-level intrusion, then security programs need to account for the human workflows attackers are actually exploiting.

Original research: Check Point Research — Shattering the Dream: When a Job Offer Becomes a Zero-Day Attack.