REDMOND, Wash. – On the morning Microsoft released its August 2026 Patch Tuesday, the update contained a fix for a vulnerability that North Korean state hackers had already been using for weeks. The patch was one of 400. The exploit was in the wild.
Researchers at Check Point Research confirmed Tuesday that Lazarus Group, the hacking collective controlled by North Korea’s Reconnaissance General Bureau, had been actively exploiting a previously undisclosed flaw in the Windows Ancillary Function Driver for WinSock – a low-level networking component present in virtually every modern Windows installation – to deliver FudModule, a kernel-mode rootkit designed to disable security software at its foundation. The flaw, tracked as CVE-2026-68820 and scored 7.0 by Microsoft, allowed an attacker who had already established a foothold on a machine to escalate privileges to SYSTEM-level access, then install a rootkit operating below the visibility threshold of most endpoint detection tools.
The campaign has been running under the name Operation Dream Job for years. Lazarus Group uses it to reach technical workers – software developers, defense contractors, aerospace engineers – with what appear to be legitimate recruitment materials: a fake technical assessment, a PDF styled as an employment contract. The victim opens it. The malware follows. Check Point’s researchers said the FudModule variant delivered via CVE-2026-68820 is a significant upgrade over earlier versions of the rootkit, with expanded capabilities to interfere with Windows security processes at the kernel level, specifically designed to neutralize the security tools organizations depend on to detect exactly this kind of intrusion.
Microsoft patched the vulnerability Tuesday alongside 399 others, a total of 400 flaws across Windows, Exchange Server, SharePoint, Microsoft Office, Azure services, Dynamics 365, Power Apps, and more than a dozen additional product families. The count is nearly double Microsoft’s June 2026 Patch Tuesday, which at 206 CVEs was itself the largest single-month release in the company’s history when it landed two months ago. August has already replaced it.
The most dangerous unexecuted vulnerability in the release is a stack-based buffer overflow in the Windows DNS Server component, CVE-2026-62878, carrying a CVSS score of 9.8. It requires no authentication, can be reached remotely, and researchers described it as “wormable” – meaning a working exploit could spread between DNS servers without requiring any user interaction. Microsoft’s internal advisories rated exploitation as “less likely,” a classification that, as SecurityWeek noted, has historically been overtaken by events when the underlying flaw is unauthenticated and network-accessible. Organizations running on-premises DNS infrastructure should treat Tuesday’s patch as urgent.
Among the 42 critical flaws is a two-part attack chain against SharePoint. CVE-2026-55040 provides authentication bypass; CVE-2026-63520 follows with remote code execution. Used together on an unpatched server, the chain would allow an unauthenticated attacker to execute arbitrary code without credentials. Microsoft has not confirmed whether proof-of-concept code exists for the chain, though combined bypass-plus-RCE patterns against collaboration platforms attract rapid weaponization once a patch is reverse-engineered. Additional critical fixes address a wormable QUIC protocol flaw, a vulnerability in Windows Deployment Services, and two publicly disclosed privilege-escalation issues – CVE-2026-62832 in the Windows User Profile Service and CVE-2026-72971 in the Windows Container Isolation driver – neither of which Microsoft confirmed was exploited before Tuesday.
The Lazarus Group exploitation of the WinSock driver zero-day is not the only North Korean intrusion confirmed in the United States this week. The FBI confirmed earlier this month that a North Korean IT worker infiltrated a US federal agency after being hired under a fabricated identity, the most direct confirmation yet that North Korea’s long-running IT infiltration program has placed operatives inside the U.S. government. The two operations reflect different attack paths toward the same objective: persistent access inside systems that matter to Pyongyang.
The scale of Tuesday’s release reflects a dynamic Microsoft has publicly said will not reverse. The company has deployed AI-powered vulnerability discovery tools to find flaws in its own software faster than human researchers working in isolation could, and has warned that the monthly CVE count will continue rising as a result. The same AI tooling is available to outside researchers. Earlier this week, the Zoom Zoomsday vulnerability – a critical screen-sharing flaw that left every device in any affected meeting open to remote takeover – was disclosed by a security firm that found it using publicly available AI models in fewer than 20 prompts, a process that would previously have taken a team months. The acceleration cuts both directions.
For administrators managing Windows environments, the immediate priority is clear. CVE-2026-68820 – the Lazarus-exploited WinSock flaw – should be patched first, followed by the DNS Server wormable RCE, then the SharePoint bypass chain. The full update is available through Windows Update, Windows Server Update Services, and the Microsoft Update Catalog, as BleepingComputer reported.
What Tuesday’s announcement does not contain is an answer to the question that matters most to anyone running Windows in a sector Lazarus typically targets. How many machines were already running FudModule before the patch arrived? The rootkit is specifically designed to defeat the security tools that would normally provide that answer. Check Point Research did not specify how long this particular variant of CVE-2026-68820 had been circulating before its researchers identified it. Organizations in the defense, finance, and technology sectors – the industries Operation Dream Job has consistently targeted – should consider offline forensic analysis of endpoints used by technical staff, independent of what their endpoint detection tools have logged. A rootkit built to blind those tools is not one they would have caught on their own.
