Lazarus Group Deploys Troy Backdoor via Fake Recruiters

The Lazarus Group, a highly sophisticated state-sponsored threat actor, has initiated a new wave of targeted spear-phishing campaigns designated under the “Operation Dream Job” moniker. Focusing primarily on the defense and aerospace sectors in Europe and India, intelligence reports confirm the deployment of a sophisticated backdoor tracked as “Troy”. The primary infection vector involves targeting corporate personnel with highly tailored, fraudulent recruiter messages on professional networking platforms, demonstrating the Lazarus Group‘s ongoing mastery of psychological exploitation and highly targeted social engineering.

Technical Analysis of the ‘Troy’ Backdoor and FudModule Rootkit

Once a victim engages with the fake recruiter, they are coerced into downloading trojanized PDF viewer applications (often disguised as “SecurityPDF”). These seemingly benign installers contain a hidden payload that silently reflectively loads the “Troy” malware into memory. Troy operates as a highly modular 64-bit DLL Remote Access Trojan (RAT) supporting 17 unique operator commands, including arbitrary file management, rapid data exfiltration, target process termination, and active dynamic link library (DLL) injection.

To escalate their foothold, the attackers aggressively exploit CVE-2026-68820, a critical use-after-free privilege escalation vulnerability residing in the Windows Ancillary Function Driver (AFD.sys). This specific flaw allows the Lazarus Group to seamlessly pivot from standard user privileges to SYSTEM-level access. Upon achieving local privilege escalation (LPE), the operators deploy an updated iteration of the notorious FudModule rootkit, effectively blinding Endpoint Detection and Response (EDR) sensors.

The malicious C2 (Command and Control) traffic is heavily obfuscated and routed through a complex network of compromised legitimate infrastructure, specifically vulnerable Roundcube webmail clients and unpatched WordPress servers, drastically complicating attribution efforts.

Defensive Posture & OT Mitigation Strategies

Organizations in targeted verticals must rapidly adapt their security awareness and endpoint defenses to counter these advanced persistent threats:

• Zero-Trust Application Control (Whitelisting): Enforce strict application whitelisting at the kernel level. Prevent the execution of unsigned or unverified software binaries, particularly PDF viewers and installers downloaded from non-official sources, mitigating the initial DLL load phase.
• Patch CVE-2026-68820 Immediately: The active exploitation of the Windows Ancillary Function Driver dictates that all Windows endpoints must receive the August 2026 Patch Tuesday updates without delay to prevent LPE.
• Advanced Behavioral Monitoring (EDR): Configure EDR solutions to monitor for anomalous child processes spawning from common productivity applications. Implement memory-scanning rules specifically hunting for the reflective DLL loading techniques utilized by the Troy backdoor architecture.

Historical Context: Operation Dream Job

Troy sits inside a years-long Lazarus recruiting lure series commonly labelled Operation Dream Job. Earlier waves used fake job offers, doctored HR documents, and trojanized interview tools against defence contractors, crypto firms, and aerospace suppliers. The same desk is linked in public reporting to AppleJeus loaders, the 3CX supply-chain incident, and SWIFT-adjacent banking theft. That lineage matters: a recruiter PDF is not a one-off scam, it is a repeatable initial-access playbook.

FudModule is a BYOVD-style rootkit family Lazarus has reused to strip callbacks from EDR drivers after they already have SYSTEM. Pairing it with a fresh AFD.sys use-after-free (CVE-2026-68820) is consistent with that habit: steal a user session, elevate, then blind the sensor.

Verification Status

CyberAsia treats vendor and government write-ups on Troy / FudModule as technical reporting, not as a confirmed compromise of any named Malaysian or Indonesian firm unless a CERT names the victim. Roundcube and WordPress C2 claims should be validated against your own proxy logs (rare user-agents, POSTs to webmail paths, beacon intervals). If you only have a recruiter message and no payload hash, log it as a claim plus phishing event, not as a confirmed backdoor implant.

What a SOC Should Hunt This Week

Look for recruiter PDFs that drop a side-loaded viewer, then a 64-bit DLL in a non-standard path, then a driver load against AFD.sys. Pair that with outbound HTTPS to a Roundcube or WordPress host the user never visits. If you only have the LinkedIn message and no hash, treat it as spear-phish and block the sender domain. Do not wait for a nation-state slide. Patch CVE-2026-68820 and enforce application control on PDF tools that did not come from your software catalogue.

Defence and aerospace hiring managers should move interview files to a company-managed share. A candidate who insists you install their viewer has already failed the interview.