BleepingComputer • 1h
Lazarus Group Exploits Windows CVE-2026-68820 in 'Operation Dream Job' Campaign
The Lazarus Group is utilizing a Windows zero-day vulnerability, CVE-2026-68820, to target the global defense and aerospace sectors via "Operation Dream Job." Attackers deliver weaponized PDF files through sophisticated social engineering lures impersonating defense contractors like Lockheed Martin. The exploit triggers via modified PDF viewers, facilitating the deployment of a novel, stealthy backdoor for full system access and data exfiltration. CISA has issued an urgent mandate requiring federal agencies to patch this vulnerability within a two-week window due to the critical risk to national security infrastructure in the US, France, Germany, Brazil, and India.