Lazarus shipped a kernel zero-day behind ML-KEM, and TLS fingerprinting will not see it

Malware attributed to North Korea's Lazarus group negotiated its command channel using a post-quantum key exchange before pulling down a Windows kernel zero-day, in a campaign against defense and aerospace companies across Europe and India ^[1]. Check Point Research reported the flaw to Microsoft on July 28 and published on August 11, the day the patch shipped ^[2][3], which means the exploit ran for at least the two weeks of that disclosure window ^[4].

The bug is CVE-2026-68820, a use-after-free race condition in AFD.sys, the driver that handles network sockets in the Windows kernel ^[5]. It was the only vulnerability in August's Patch Tuesday that Microsoft flagged as under active exploitation ^[6].

The delivery mechanics are the part worth reading twice. Infection ran through MISTPEN, an in-memory downloader that talks to attacker-controlled files on OneDrive via the Microsoft Graph API ^[7]. After reconnaissance and persistence, MISTPEN loaded a dedicated module that fingerprinted the host, requested four public keys from the command server, generated fresh key material with Kyber/ML-KEM, the key encapsulation scheme NIST standardized in 2024, returned the encapsulated result, and only then asked for the exploit, which it decrypted and ran in memory ^[8]. That traffic carried a second encryption layer using GOST-CBC on top of MISTPEN's own AES transport encryption ^[9]. Three cryptographic layers, according to Check Point's account, with the innermost session keys agreed in band ^[10].

Most network detection stacks assume one of two things: that a middlebox can terminate the session and inspect what is inside, or that the client's TLS handshake will look wrong. Neither assumption holds here. Break-and-inspect on this channel yields ciphertext negotiated above the transport, not a readable exploit. Fingerprinting the client is no better when the outbound leg is Graph API traffic to OneDrive ^[7] and the relay leg lands on Roundcube webmail servers compromised through CVE-2025-49113, with credentials likely sourced from dark web leaks, alongside hijacked PrestaShop sites ^[11]. Each of those hosts ran RelayShell, a previously undocumented PHP webshell that passes traffic between operator and victim through session files rather than acting as a conventional shell ^[12]. Check Point found evidence of at least 17 such relay servers ^[13]. Their reputation and their certificates are those of legitimate businesses.

Endpoint telemetry does not pick up the slack, because that is what the exploit was for. What arrived through the handshake was FudModule, Lazarus's kernel rootkit, in a build Check Point tracks as v3.1 ^[14]. It disables telemetry callbacks, removes minifilters, kills the NT Kernel Logger and blinds 94 Event Tracing for Windows providers, and newly tampers with Smart App Control by resetting its policy state and forcing a code integrity reload ^[15].

The front end remains ordinary. Operation Dream Job still approaches employees at defense firms with fraudulent job offers ^[16], with targeting around surveillance sensors, drones and robotics and activity in France, Germany, Brazil and India ^[17]. One chain uses DLL sideloading behind a legitimate signed PDF viewer, showing a decoy job description while MISTPEN loads in memory, then deploys the ForestTiger backdoor ^[18]. The other pushes SecurityPDF, a trojanized viewer distributed from at least three sites impersonating privacy vendor Enveil, some of which ranked top in search results ^[19]; Check Point stressed Enveil was neither targeted nor compromised ^[20]. That viewer delivers Troy, a previously undocumented backdoor with 17 operator commands ^[21].

Watch whether in-band post-quantum key agreement shows up in other crews' loaders, because the engineering cost is now low and the detection cost to defenders is high. Watch AFD.sys, which produced a separate fix in November 2025 that this bug initially resembled ^[22]. And check your Roundcube estate against CVE-2025-49113 ^[11]: the relay tier is other people's servers, and next quarter it may be yours.