Check Point Research attributes a zero-day exploitation of a Microsoft Windows vulnerability to the Lazarus Group, a North Korean threat actor, in a campaign designated Operation Dream Job. The attacks target defense and aerospace companies in France, Germany, Brazil, and India, delivering a previously unseen backdoor after achieving SYSTEM-level access.

What should defenders do?

Ensure Microsoft Windows systems are updated to the latest patched version to address the exploited vulnerability. Apply security updates promptly and monitor for indicators of compromise associated with Operation Dream Job.

highZero-Day

Lazarus Group Exploits Windows Zero-Day in Operation Dream Job Campaign

North Korean threat actor targets defense and aerospace sectors with custom backdoor

CyberIntel DeskPublished about 1 month agoUpdated less than a minute ago1 min read

Lazarus Group Exploits Windows Zero-Day in Operation Dream Job Campaign

Key Takeaways

Lazarus Group attributed to zero-day exploitation of Microsoft Windows in Operation Dream Job
Defense and aerospace companies in France, Germany, Brazil, and India are targeted
A custom backdoor is deployed after achieving SYSTEM-level privilege escalation
Microsoft has patched the underlying vulnerability; updating systems is recommended

Related Security News

highCyber Attacks

Star Blizzard Campaign Targets 100+ Organizations with Fake Event Invitations

Microsoft reports that the Russian state-sponsored threat actor Star Blizzard has been conducting a sustained campaign since January 2026, using fake event invitations to trick targets into installing a backdoor on Windows computers. The operation has affected more than 100 organizations, primarily in the U.S. and U.K., with victims tied to Ukraine. At least one infection has been confirmed, though the full extent of breaches and data exfiltration remains unverified.

The Hacker Newsabout 5 hours ago1 min read