North Korea's Lazarus Uses Quantum-Resistant Encryption To Hide Zero-Day Attacks on Defence and Aviation Firms

North Korea's Lazarus Group used a previously unknown Windows flaw and quantum-resistant encryption in a campaign against defence, aerospace and aviation organisations, according to researchers.

Check Point Research said the group combined the zero-day vulnerability with fake recruitment approaches, a kernel-level rootkit and compromised third-party infrastructure to reach and infiltrate targets.

Encryption Added Another Layer To Stealthy Campaign

Researchers said Lazarus had been exploiting CVE-2026-68820, a flaw in the Windows AFD.sys driver, before Microsoft patched it on 11 August. The vulnerability is a use-after-free flaw in AFD.sys, the Windows component responsible for network socket operations.

Check Point said an attacker with an existing foothold could exploit the flaw to elevate privileges to SYSTEM, the highest level of access on a Windows machine. Microsoft included a fix in its 11 August security update.

The zero-day was not the initial route into the targeted systems. According to Check Point, Lazarus first used its long-running Operation Dream Job campaign to approach engineers and other potential victims with fraudulent recruitment offers, then used malicious files to establish an initial foothold.

Once inside, the attackers could use the Windows flaw to raise their privileges and deploy additional malware.

Lazarus Turned to Quantum-Resistant Cryptography

The campaign's communications were protected with ML-KEM, formerly known as Kyber, according to Check Point. ML-KEM is a post-quantum key encapsulation mechanism standardised by the US National Institute of Standards and Technology (NIST).

Post-quantum cryptography is intended to protect encrypted communications from future quantum computers that could defeat some widely used public-key encryption methods.

NIST finalised its first post-quantum cryptography standards in 2024. Lazarus' use of the technology does not mean the group has access to a quantum computer.

Instead, the encryption adds another obstacle for defenders attempting to inspect or intercept communications during the campaign. Post-quantum cryptography is normally discussed as a defensive technology aimed at preparing systems for a future threat.

Researchers say a North Korea-linked group used the same class of technology as part of an active cyber operation.

Hijacked Firms Turned Into Attack Infrastructure

Lazarus also relied on systems it did not own. Researchers identified at least 17 compromised servers being used to relay traffic, including Roundcube webmail servers and compromised online shops.

The group also used at least one previously compromised French organisation to launch spear-phishing against additional victims. That gave the attackers another way to blend into legitimate infrastructure.

Sergey Shykevich, threat intelligence director at Check Point, said the group used the identities and reputations of organisations it had already compromised. 'They hid in plain sight, behind top-ranked search results, real vendor branding, and the reputation of organizations they had already compromised,' he said.

The approach in simpler terms means a compromised company can become more than a victim. Its infrastructure and reputation can become part of the next attack.

Fake Job Offers Gave Attackers Their Way In

The campaign is part of Operation Dream Job, which Lazarus has used for years to target technical workers with fraudulent employment offers. Researchers said the latest activity included impersonation of recruiters connected to Lockheed Martin and privacy technology company Enveil. Enveil itself was not compromised, according to the researchers.

Targets were contacted through LinkedIn and messaging applications before being sent malicious files presented as recruitment material. The social engineering gave attackers the foothold needed to exploit the Windows vulnerability.

The combination is important because CVE-2026-68820 is a privilege-escalation flaw rather than a standalone initial-access vulnerability.

FudModule Obscured the Intrusion

After gaining higher privileges, Lazarus deployed FudModule, a kernel-level rootkit associated with the group. Researchers said the malware disabled 94 Event Tracing for Windows monitoring channels and interfered with Smart App Control.

That can reduce the visibility available to security teams investigating suspicious activity on an infected machine. Targets were concentrated in France, Germany, Brazil and India, according to the research. The affected organisations included companies working with military technologies such as surveillance sensors, drones and robotics.

Microsoft Has Closed the Zero-Day Hole

Check Point reported CVE-2026-68820 to Microsoft on 28 July. Microsoft released the security fix on 11 August, and current security reporting identifies the vulnerability as actively exploited in the wild.

The patch closes the Windows vulnerability, but it does not remove the other parts of the campaign. Lazarus was also relying on social engineering, compromised infrastructure, third-party identities and malware designed to suppress security monitoring.

The result was a layered operation in which the zero-day was only one component. The use of ML-KEM adds another unusual layer: technology designed to prepare communications for a post-quantum world was being used during a cyber operation against defence and aviation targets.