Urgent update: North Korean hackers have targeted users of Windows

Microsoft has issued critical security updates following the discovery of a zero-day vulnerability actively exploited by the North Korean hacking group Lazarus, according to reports published on Tuesday. The flaw, found in a Windows driver known as AFD.sys, allows attackers to gain system control and deploy malware, prompting urgent calls for users to apply the latest patches immediately. The vulnerability was identified as part of a targeted campaign named "Operation Dream Job," which has been active since early 2026. According to cybersecurity firm Check Point, the attack primarily targets individuals in Europe and India working within defense sectors. These victims are lured with attractive job offers, leading them to visit compromised websites where they download a malicious PDF containing an embedded exploit. Once executed, this exploit leverages the unpatched vulnerability to install a new version of the Fudmodule rootkit, granting attackers remote access to the infected systems. The severity of the flaw is rated high with a CVSS score of 7.0, indicating its potential for widespread impact. Microsoft addressed this specific issue alongside 421 other vulnerabilities during its August Patch Day, marking one of the largest update cycles in recent months. Of these, 236 were related to Windows operating systems, though the number does not represent a record, July saw the closure of 622 security flaws. Lazarus, a well-known state-sponsored hacking group linked to North Korea, has previously been associated with several high-profile cyberattacks. This particular campaign appears to be part of a broader trend in which advanced persistent threats increasingly target specific industries and regions using sophisticated social engineering tactics combined with technical exploits. In addition to the Lazarus-related vulnerability, Microsoft's patch day included fixes for numerous other serious issues. One notable example involves a critical flaw in the Windows DNS server component, which could allow attackers to inject malicious code into network infrastructure through specially crafted data packets. Security researcher Dustin Childs from the Zero Day Initiative highlighted this risk, emphasizing the need for prompt remediation. The increased frequency of such vulnerabilities being discovered and patched reflects advancements in artificial intelligence tools used by both attackers and defenders. These technologies have significantly enhanced the ability to detect and address security weaknesses, contributing to the current surge in reported exploits. As organizations continue to face evolving cyber threats, the importance of timely software updates cannot be overstated. With each new patch cycle, companies must remain vigilant against emerging risks while ensuring their systems are protected against known vulnerabilities. The ongoing collaboration between cybersecurity firms and technology providers plays a crucial role in maintaining digital resilience against increasingly complex attacks.