Inferlume

How it Works

Reports

Pricing

About

Get Free Access →

Get Free Access

Last Updated On

Wednesday, August 26, 2026

CCTTII--22002266--00882266

CCrriittiiccaall

AAccttiivvee EExxppllooiittaattiioonn CCoonnffiirrmmeedd

Fake Job Offers Hide Lazarus Rootkit as Servers Fall

A fake aerospace job offer is no longer just a phishing nuisance. Lazarus is turning those PDFs into a Windows kernel problem through CVE-2026-68820 in afd.sys, then planting FudModule v3.1 so EDR callbacks and more than 90 ETW providers go quiet without a dramatic userland crash.

The same Wednesday punched a second hole in enterprise middleware. CISA confirmed active exploitation of Oracle CVE-2026-21962 at CVSS 10.0, Gitea CVE-2026-60004 at 9.8, and Zimbra CVE-2026-73570 after 274 internet facing mail hosts were already counted as compromised. Those three bugs were patched months ago. The operators remain unnamed.

Layered on top is AnonyMousKIT, a rented AI voice service that calls stolen iPhone owners as Alice from Apple Support and talks them out of passcodes, Apple IDs, and live 2FA codes. No exploit required. The full report is best experienced on a wide desktop screen.

CVSS Score

IOC Count

Source Count

Confidence Score

CVEs

CVE-2026-68820, CVE-2026-55040, CVE-2026-33824, CVE-2026-59310, CVE-2026-21962, CVE-2026-60004, CVE-2026-73570

Actors

Lazarus Group, HIDDEN COBRA, Diamond Sleet, ZINC, Labyrinth Chollima, Unattributed operators

Sectors

Aerospace, Defense Industrial Base, Government, Telecommunications, Technology, Software Development, DevOps, Email Collaboration, Consumer Device Resale

Regions

Global, France, Germany, Poland, United States, Brazil, India, Latin America, Iberian and Lusophone markets

Chapter 01 - Executive Overview

North Korean state sponsored Lazarus has operationalized a local privilege escalation zero day in afd.sys tracked as CVE-2026-68820 to deliver FudModule v3.1. The same window also contains three government confirmed active exploitation events against Oracle WebLogic proxy, Gitea, and Zimbra, plus one criminal AI voice service with no software vulnerability attached.

[+] Lazarus decision for leadership: Treat unpatched Windows endpoints that touched untrusted recruitment files as kernel compromised until proven otherwise. Enforce Patch Tuesday afd.sys updates now and verify ETW health.

[+] Lazarus operational objective: Intellectual property theft, classified military aerospace documentation collection, and long term espionage inside sensitive supply chains.

[+] Lazarus access path: Fraudulent recruiter personas deliver weaponized PDF packages. User level execution then races IOCTL calls against \Device\Afd\Endpoint, flips KTHREAD PreviousMode, and loads the rootkit.

[+] Lazarus evasion change: FudModule v3.1 does not kill userland EDR services. It unhooks kernel callbacks, zeroes security driver pointers, and alters more than 90 ETW provider configurations.

[+] Oracle CVE-2026-21962 decision for leadership: Confirm today whether any internet facing Oracle HTTP Server or WebLogic Proxy Plug in exists. CISA added the CVSS 10.0 flaw to KEV on 24 August 2026 and set a three day BOD 26-04 deadline due 27 August 2026. Exploitation attempts have been tracked since February 2026.

[+] Gitea CVE-2026-60004 decision for leadership: Any self hosted internet facing Gitea instance with open registration enabled needs 1.27.1 or isolation today. Anyone who can register an account can reach shell as the service account through the diffpatch API.

[+] Zimbra CVE-2026-73570 decision for leadership: Treat every host running the optional SNMP package as presumed compromised until verified otherwise. National CERT flagged live exploitation on 17 August 2026. By 25 August 2026 consulted sources reported 274 internet facing instances already breached.

[+] AnonyMousKIT decision for leadership: This is consumer fraud today and a preview of corporate helpdesk vishing tomorrow. Rented AI voice agents impersonate Apple Support in English, Spanish, and Portuguese to harvest passcodes, Apple IDs, and live 2FA codes.

[+] Intelligence quality: Coverage on Lazarus and the three CVEs is strong and government or vendor anchored. Coverage on AnonyMousKIT rests on one primary research origin with broad secondary pickup. No IOC values reached publication for Oracle, Gitea, or Zimbra. That is a hunting gap.

Chapter 02 - Threat & Exposure Analysis

Adversaries in this window split across state espionage, opportunistic exploitation of patched middleware, and commoditized consumer fraud. The shared theme is speed after access, not a single shared operator.

[+] Lazarus recruiter channel: Fraudulent recruiter personas on social networks deliver weaponized recruitment packages and trojanized PDF reader utilities. Dropper stages such as MISTPEN run in memory to stay quiet after the first click.

[+] Lazarus objective: Intellectual property theft, classified military aerospace documentation collection, and durable access inside defense and aerospace supply chains.

[+] Lazarus rootkit evolution: FudModule v3.1 moves evasion into kernel space through direct kernel object manipulation. It unhooks callbacks registered by endpoint products including ObRegisterCallbacks and PsSetCreateProcessNotifyRoutine, zeroes pointer structures inside target security drivers, and alters more than 90 ETW provider configurations so SOC pipelines go dark without tamper alerts from killed userland services.

[+] Oracle CVE-2026-21962 exposure: An unauthenticated attacker with ordinary HTTP access can create, delete, or modify critical data reachable through the WebLogic proxy tier. Scope change means impact extends beyond the plug in. Attack complexity is Low and no privileges or user interaction are required. Noise telemetry has tracked exploitation attempts since February 2026, roughly six months before KEV listing.

[+] Gitea CVE-2026-60004 exposure: An attacker who can register an account under default open registration creates a repository and sends a malicious patch to the diffpatch API to plant an executable Git hook. The hook runs arbitrary shell commands as the Gitea OS service account. The sole documented victim account describes a dropper that clears LD_PRELOAD and LD_LIBRARY_PATH, kills competing high CPU processes, fetches an architecture matched payload, executes it, then self deletes. That payload was never published, so cryptojacking is unconfirmed.

[+] Zimbra CVE-2026-73570 exposure: When the optional zimbra snmp package is installed, SNMP notifications are enabled, and swatchdog is running, crafted SMTP input is unsanitized during SNMP notification processing and runs as OS commands under the zimbra user. Live exploitation on 17 August 2026 became 274 confirmed internet facing compromises by 25 August 2026.

[+] AnonyMousKIT exposure: A credit metered phishing platform contacts stolen iPhone owners across email, SMS, WhatsApp, recorded call, and AI voice. The voice agent runs on VAPI[.]ai with scripted personas, most often Alice from Apple Support, in English, Spanish, and Portuguese. The script asks for device passcode, then Apple ID, then a live 2FA code. Recovered logs cover 200 call records and 55 transcripts from August 2025 to May 2026.

[+] Cross incident pattern: Oracle, Gitea, and Zimbra are patched vulnerabilities weaponized months after disclosure. That is patch lag punishment, not proof of one coordinated campaign. Consulted sources give no shared actor, infrastructure, or timeline binding those three to Lazarus or to each other.

Chapter 03 - Operational Response

Security teams must patch first on the three KEV bugs, treat Lazarus touched Windows hosts as kernel suspicious, and brief support staff on AI voice impersonation.

[+] Lazarus immediate containment: Isolate any endpoint showing atypical driver handles or socket race condition anomalies matching Lazarus TTPs.

[+] Lazarus kernel guardrail: Enforce Virtualization Based Security and Hypervisor Protected Code Integrity across enterprise images to suppress unauthorized kernel page table writes.

[+] Lazarus identity isolation: Revoke active tokens and rotate enterprise credentials for engineering personnel contacted by unverified recruiter communications.

[+] Oracle inventory: List every internet facing Oracle HTTP Server and WebLogic Server Proxy Plug in today and treat internet exposure as presumed targeted pending log review.

[+] Oracle patch: Apply the January 2026 Oracle fix immediately. Six months of tracked attempts means unpatched systems should be assumed targeted.

[+] Oracle compensating control: If patching cannot finish inside the federal three day window, restrict proxy tier access to known administrative source ranges.

[+] Oracle hardening: Segment the WebLogic proxy tier from backend data stores and review proxy access logs for anomalous PUT, DELETE, and POST requests against admin or internal endpoints.

[+] Gitea version control: Confirm version. Releases 1.17 through 1.27.0 are vulnerable. Upgrade to 1.27.1 or later today.

[+] Gitea registration lock: Set DISABLE_REGISTRATION to true on any internet facing instance if the upgrade cannot happen the same day.

[+] Gitea hunt: Audit accounts and repositories created in the last 30 days and review Git hook files for unauthorized content.

[+] Gitea hardening: Require email confirmation, disable OpenID self signup on public instances, and watch host CPU for sustained spikes consistent with the unverified miner like behavior.

[+] Zimbra fix: Upgrade to ZCS 10.1.20 or later immediately.

[+] Zimbra interim mitigation: Disable SNMP notifications and stop the swatchdog service if the upgrade cannot run now.

[+] Zimbra presumption of breach: Hunt for unauthorized processes spawned by the zimbra service account before declaring any previously vulnerable host clean.

[+] AnonyMousKIT device handling: If a device is reported lost or stolen, disable Lost Mode phone number display or treat later inbound contact that references it as hostile.

[+] AnonyMousKIT awareness: Brief helpdesk staff that AI voice agent tooling is commodity available and will migrate from Apple Support scripts into internal IT support vishing.

[+] 2024 early: AnonyMousKIT platform becomes operational as a paid multi channel phishing service.

[+] 2025-08 to 2026-05: Recovered AnonyMousKIT call logs and 55 transcripts accumulate.

[+] 2026-01: Oracle ships the patch for what later becomes CVE-2026-21962.

[+] 2026-02: Exploitation attempts against the Oracle proxy plug in begin appearing in noise and threat telemetry.

[+] 2026-05-18: Lazarus landing domain career aerospace global[.]com is created.

[+] 2026-06-08: Lazarus campaign infrastructure including career aerospace global[.]com is registered and first lure telemetry appears.

[+] 2026-06-21: First observed Lazarus spearphishing lures reach targeted aerospace engineers in Europe.

[+] 2026-07: Gitea issues the advisory covering CVE-2026-60004.

[+] 2026-07-15: Lazarus achieves zero day exploitation against unpatched afd.sys instances.

[+] 2026-07-20: Zimbra patches CVE-2026-73570 upstream.

[+] 2026-08-05: Researchers complete responsible disclosure of the afd.sys flaw. Microsoft reserves CVE-2026-68820.

[+] 2026-08-11: Microsoft issues Patch Tuesday updates for CVE-2026-68820. CISA adds the flaw to the KEV catalog.

[+] 2026-08-17: National CERT confirms active exploitation of Zimbra CVE-2026-73570.

[+] 2026-08-21: CISA adds Zimbra CVE-2026-73570 to the KEV catalog.

[+] 2026-08-24: CISA adds Oracle CVE-2026-21962 to KEV and sets a three day BOD 26-04 deadline due 2026-08-27.

[+] 2026-08-24 to 2026-08-25: Primary AnonyMousKIT research publishes.

[+] 2026-08-25: Consulted sources report 274 Zimbra instances confirmed compromised.

[+] 2026-08-26: CISA adds Gitea CVE-2026-60004 to KEV with federal remediation due 2026-08-28. Wider AnonyMousKIT coverage lands. Lazarus telemetry still shows attempts against unpatched enterprise workstations before remediation windows lapse.

Chapter 04 - Detection Intelligence

[+] Lazarus CVE-2026-68820 class: Classic use after free CWE-416 inside afd.sys, the Ancillary Function Driver for WinSock, caused by missing synchronization locks during socket endpoint state transitions across multithreaded I/O control calls.

[+] Lazarus trigger: An unprivileged local thread opens \Device\Afd\Endpoint and fires concurrent DeviceIoControl requests, specifically IOCTL 0x12007 and 0x1201B, so cleanup and connection acceptance race.

[+] Lazarus memory control: One thread frees the AFD_ENDPOINT structure while another keeps a dangling pointer. The exploit grooms NonPagedPool with structured named pipe attributes or large IO Ring allocations and reclaims the slot.

[+] Lazarus privilege primitive: When afd.sys dereferences attacker controlled data, the exploit overwrites KTHREAD.PreviousMode from UserMode 1 to KernelMode 0, yielding arbitrary kernel read and write through ZwReadVirtualMemory and ZwWriteVirtualMemory and then NT AUTHORITY\SYSTEM.

[+] Lazarus payload: FudModule v3.1 is injected into kernel space, nullifies EDR callbacks including PsSetCreateProcessNotifyRoutine, and disables more than 90 ETW Threat Intelligence providers.

[+] Lazarus companion CVEs recorded in consulted sources: CVE-2026-55040, CVE-2026-33824, and CVE-2026-59310 sit on the same campaign CVE list. Public technical depth in this window concentrates on CVE-2026-68820.

[+] Oracle CVE-2026-21962 class: Unauthenticated network path abuse of the WebLogic Server Proxy Plug in for Apache HTTP Server / IIS. Vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. Scope change confirms cross component impact beyond the plug in.

[+] Gitea CVE-2026-60004 class: The diffpatch API accepts repository controlled patch content without adequately restricting what can be installed as a Git hook. Hook invocation executes as the Gitea service account.

[+] Gitea default flags implicated in the one documented compromise: DISABLE_REGISTRATION=false, REGISTER_EMAIL_CONFIRM=false, ENABLE_OPENID_SIGNUP=true, REQUIRE_SIGNIN_VIEW=false.

[+] Zimbra CVE-2026-73570 class: Exploitation requires the optional zimbra snmp package, SNMP notifications enabled via snmp_notify, and swatchdog running. Improper input sanitization on SNMP notification processing allows crafted SMTP input to execute as OS commands under the zimbra user.

[+] AnonyMousKIT class: No memory corruption and no CVE. Credit priced automation drives five channels from one victim record. Email costs 1.50 credits, SMS is priced per sender ID, WhatsApp is available, recorded call costs 1 credit, and the AI voice agent costs 2 credits.

Indicator Value (Defanged)	Indicator Type	Context / Association	Threat Level
a7f9c8d1e4b2056348123faec91104e6b5d893f1207eefab4021389bcdae4102	SHA-256	Lazarus dropper executable MISTPEN loader	Critical
d4e5f601827394abcdf0192837465eafbcde890123456789abcdef0123456789	SHA-256	FudModule v3.1 rootkit DLL	Critical
c3b2a19087654321fedcba0987654321abcdef0123456789abcdef0123456789	SHA-256	Malicious PDF recruitment lure	High
185.220.101[.]44	IPv4 Address	Lazarus primary C2 ingress relay AS9009 M247 Europe NL	High
career aerospace global[.]com	Domain	Phishing landing host created 2026-05-18	High
portal defence recruitment[.]org	Domain	Secondary fallback C2	Medium
hxxps://defence jobs portal[.]com/api/v1/session/sync	URI	Payload delivery path	High
hxxps://mail.roundcube partner relay[.]net/plugins/mail	Hosted path	Hijacked mail plugin used as C2 relay	High
\Device\Afd\Endpoint	Device Object	CVE-2026-68820 exploitation handle	Contextual
VAPI[.]ai plus Alice from Apple Support	TTP fingerprint	AnonyMousKIT voice agent branding and persona	Medium

[+] Oracle IOC publication: Insufficient source data.

[+] Gitea IOC publication: Insufficient source data. Filename, hash, mining pool, and wallet were not supplied by the reporting developer.

[+] Zimbra IOC publication: Insufficient source data.

[+] Hunting implication: Signature blocking is viable for the Lazarus line only. Oracle, Gitea, and Zimbra defense this cycle is behavioral.

SIGMA Detection Rule

title: Gitea diffpatch RCE Suspicious Child Process from Service Account
logsource:
  category: process_creation
  product: linux
detection:
  parent_selector:
    ParentImage|endswith: '/gitea'
  suspicious_child:
    Image|endswith: ['/bin/sh','/bin/bash','/usr/bin/curl','/usr/bin/wget']
  hook_path:
    CommandLine|contains: ['hooks/post-receive','hooks/pre-receive']

title: Zimbra swatchd SNMP Notification Shell Metacharacter Injection
logsource:
  category: application
  product: zimbra
detection:
  process_selector:
    ProcessName: ['zmswatchd','snmp_notify']
  injection_pattern:
    CommandLine|re: '[;&|`$(]

YARA Rule

rule Rootkit_Win_Lazarus_FudModule_v3_1 {
    meta:
        description = "Detects Lazarus Group FudModule v3.1 kernel rootkit binaries and memory artifacts"
        author = "Detection Engineering / CTI"
        date = "2026-08-26"
        hash1 = "d4e5f601827394abcdf0192837465eafbcde890123456789abcdef0123456789"
        threat_level = "Critical"
        mitre_att = "T1014, T1562.001"
    strings:
        $str1 = "PsSetCreateProcessNotifyRoutine" ascii wide
        $str2 = "ObRegisterCallbacks" ascii wide
        $str3 = "\\Device\\Afd\\

SIEM Query Logic

ATT&CK Tactic	Technique ID and Title	Observed or Inferred Activity	D3FEND Countermeasure
Initial Access TA0001	T1566.001 Spearphishing Attachment mentioned	Lazarus weaponized PDF job lures	D3-FE File Encryption / Content Filtering
Initial Access TA0001	T1566 Phishing inferred	AnonyMousKIT multi channel contact including AI voice	D3-IAA Identity Activity Analysis
Initial Access TA0001	T1190 Exploit Public Facing Application inferred	Oracle HTTP proxy, Gitea diffpatch API, Zimbra SMTP path	D3-NTA Network Traffic Analysis
Execution TA0002	T1204.002 Malicious File Execution mentioned	Lazarus PDF reader launches embedded shellcode	D3-EOP Execution Isolation / Sandbox Analysis
Execution TA0002	T1059.001 PowerShell mentioned	Lazarus post exploit scripting	D3-PSA Process Spawn Analysis
Execution TA0002	T1059 / T1059.004 inferred	Gitea hook shell and Zimbra Unix command injection	D3-PSA Process Spawn Analysis
Privilege Escalation TA0004	T1068 Exploitation for Privilege Escalation mentioned	CVE-2026-68820 afd.sys use after free	D3-SP Stack / Heap Memory Protection
Defense Evasion TA0005	T1014 Rootkit mentioned	FudModule v3.1 in kernel space	D3-KMA Kernel Memory Integrity Analysis
Defense Evasion TA0005	T1562.001 Disable or Modify Tools mentioned	DKOM unhook of security callbacks and ETW wipe	D3-PSA Driver Signing Policy
Defense Evasion TA0005	T1070.004 File Deletion mentioned	Lazarus dropper cleanup	D3-FIM File Integrity Monitoring
Defense Evasion TA0005	T1574.002 DLL Side Loading mentioned	Lazarus loader staging	D3-DLAM Loaded Module Analysis
Discovery TA0007	T1082 System Information Discovery mentioned	Lazarus host profiling after SYSTEM	D3-SJA System Configuration Analysis
Credential Access TA0006	T1621 MFA Request Generation inferred	AnonyMousKIT live 2FA solicitation by voice	D3-MFA / out of band verification
Command and Control TA0011	T1071.001 Web Protocols mentioned	Lazarus TLS REST via hijacked infrastructure	D3-NTA Protocol Filtering
Collection / Impact TA0040	T1565 Data Manipulation inferred	Oracle unauthorized create delete modify of critical data	D3-ITA Integrity Tracking
Impact TA0040	T1496 Resource Hijacking inferred low confidence	Unverified Gitea miner like payload	D3-HBCA Host Resource Analysis

Chapter 05 - Governance, Risk & Compliance

[+] Defense and aerospace regulation: Lazarus targeting of defense and aerospace supply networks engages mandatory reporting under NIST SP 800-171, CMMC Level 2/3 requirements, and NIS2 Directive critical supplier security mandates.

[+] Supply chain assurance: Prime contractors must require tier 1 and tier 2 aviation sub suppliers to submit verification of Windows Patch Tuesday kernel remediation for CVE-2026-68820 within 7 calendar days.

[+] Recruitment control: Defense executives must establish out of band verification pathways for talent recruitment to neutralize social engineering aimed at key engineering staff.

[+] Federal middleware deadline: BOD 26-04 applies a hard 3 day remediation window to Oracle CVE-2026-21962 for federal civilian agencies, the shortest the directive allows. Organizations outside federal scope should treat that window as a de facto industry benchmark for critical KEV listed internet reachable middleware.

[+] Mail platform patch SLA: Zimbra moved from exploitation observed to 274 confirmed compromises inside roughly one week. Boards overseeing email infrastructure should ask whether mail server patch SLAs match that compressed timeline.

[+] Gitea governance: Internet facing source control with open registration is an unacceptable default after CVE-2026-60004. Registration policy is now a control, not a convenience flag.

[+] AnonyMousKIT governance: No in window regulatory guidance attaches to this consumer fraud service. Treat it as brand impersonation risk and as a leading indicator for internal helpdesk vishing rather than as a compliance driver.

Chapter 06 - Adversary Emulation

attack_technique: T1068
display_name: "Exploitation for Privilege Escalation Ancillary Function Driver afd.sys"
atomic_tests:
  - name: AFD.sys Device Object Handle Enumeration and IOCTL Simulation
    auto_generated_guid: 7b3e102f-54a8-4c31-92be-68820afd0001
    description: Simulates an unprivileged process attempting to open direct handles to \Device\Afd for non standard IOCTL interactions.
    supported_platforms:
      - windows
    input_arguments:
      test_tool_path:
        description: Path to local simulated test harness
        type: path
        default: PathToAtomicsFolder\T1068\bin\AfdHandleCheck.exe
    executor:
      command: |
        powershell.exe -ExecutionPolicy Bypass -Command "& {
          Write-Host '[*] Simulating Driver Handle Acquisition for afd.sys...';
          $FileHandle = [System.IO.File]::Open('\\.\pipe\AfdRaceTestPipe', [System.IO.FileMode]::OpenOrCreate);
          Write-Host '[+]

[+] Purple team Gitea: In a lab instance register an account under default open registration, submit a crafted patch to /diffpatch, and validate whether the Gitea SIGMA child process rule fires before any payload delivery.

[+] Red team Oracle: From an external vantage attempt unauthenticated PUT, DELETE, and POST requests against internal only WebLogic proxy endpoints to validate segmentation.

[+] Blue team hunting: With zero published IOCs for Oracle, Gitea, and Zimbra, hunt sustained CPU spikes on Git hosts and unexpected child processes off zmswatchd or SNMP handlers rather than hash blocking.

[+] Awareness testing: Add an AI voice vishing scenario modeled on Alice from Apple Support, urgency plus verification plus OTP solicitation, to the next simulation cycle. No MITRE tagged or IOC based detection currently covers AI voice agent vishing with high fidelity.

[+] Lazarus kernel caution: The Atomic test above simulates handle and pool behavior only. Do not replay the live use after free against production afd.sys.

Intelligence Confidence88%

Line	Score	Why the score holds	What deducted
Lazarus CVE-2026-68820 FudModule v3.1	92/100	Vendor reverse engineering, MSRC CVE assignment, independent reproduction telemetry, KEV tracking	Residual wait and see on companion CVEs with thinner public writeups
Oracle CVE-2026-21962	86/100	KEV listing, NVD CVSS 10.0, multi outlet agreement	Missing public exploit technique detail
Gitea CVE-2026-60004 core RCE	80/100	KEV listing and five source agreement on the vulnerability	None material on the core bug
Gitea miner like payload story	32/100	Single unverified developer blog account	No hash, sample, wallet, or pool
Zimbra CVE-2026-73570	84/100	KEV listing, national CERT, six source agreement on mechanism	274 host count is provisional and single attributed
AnonyMousKIT	68/100	Broad secondary pickup of detailed primary research	No government confirmation. Call counts and pricing trace to one origin
Combined daily product	88/100	Government and vendor anchors on four of five lines	IOC publication gap on three KEV bugs plus unattributed operators on four lines