Lazarus Uses Windows Zero-Day for Persistent Backdoor

North Korean cyber‑espionage unit Lazarus Group leveraged a newly patched Microsoft Windows flaw to deploy a never-before-seen backdoor targeting defense and aerospace companies across France, Germany, Brazil, and India.¹

The exploit was attributed by Check Point Research as part of Operation Dream Job, a long-running campaign that began at least in 2017 and repeatedly used fake job offers via LinkedIn to gain initial footholds before dropping malware such as LightBase (detected early 2023).¹

Technical analysis suggests the new backdoor likely uses kernel driver techniques or similar privilege-escalation methods that are difficult to detect with standard endpoint security tools—a pattern also seen in APT41 attacks on gaming firms between Q1/Q2 2020 through late 2021 when they were sanctioned under Executive Order 13876.

Microsoft's Patch Tuesday cycle is critical here but not always sufficient for organizations that delay updates.

Lazarus’s use of social engineering tactics—fake job postings—to infiltrate networks echoes their earlier “Operation Dream Job” approach, illustrating a multi-layered strategy that combines phishing, credential theft, and stealthy installation of backdoors. The recent backdoor may be based off Cobalt Strike, which state sponsors have used extensively in past campaigns.

The incident highlights the persistent threat posed by nation‑state actors who combine newly discovered flaws with sophisticated delivery mechanisms. It stresses the importance of timely patching, vigilant monitoring of privileged processes, and advanced threat detection solutions capable of spotting kernel-level anomalies.