Lazarus exploits Windows zero-day in defense attacks

North Korean Lazarus hackers exploited Windows zero-day CVE-2026-68820, a use-after-free in AFD.sys, to target defense firms via Operation Dream Job. Microsoft patched it this month. Check Point found the FudModule rootkit and new Troy backdoor, plus RelayShell webshell on compromised Roundcube servers.