North Korean Hackers Exploit Windows Zero-Day in Defense Espionage Campaign

North Korean hackers have exploited a previously unknown security flaw in Microsoft Windows to target defense and aerospace companies across Europe, South America, and Asia as part of a long-running espionage campaign. The activity, identified by cybersecurity researchers, leveraged a zero-day vulnerability to install a new backdoor and gain complete control of compromised systems.

The campaign, known as Operation Dream Job, involves threat actors impersonating recruiters on professional networking sites like LinkedIn. They contact employees at targeted firms with fraudulent but convincing job offers from companies such as Lockheed Martin and Enveil. The goal is to build trust and trick victims into opening malicious files, which then deploy malware to steal sensitive data and establish persistent access.

The latest wave of attacks exploited a vulnerability tracked as CVE-2026-68820, a privilege escalation flaw in the Windows Ancillary Function Driver for WinSock (AFD.sys). Microsoft patched the flaw in its August 2026 security updates, confirming it was being actively exploited in the wild. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) subsequently ordered...