North Korea Hackers: Twice Through the Same Door

Between early 2026 and July 2026, Lazarus Group ran two parallel infection chains against defence and aerospace organisations in France, Germany, Brazil and India, both terminating in the exploitation of CVE-2026-68820 — a use-after-free race condition in the Windows Ancillary Function Driver for WinSock (afd.sys) that escalates a low-privileged user to SYSTEM. Microsoft patched the flaw on 11 August 2026 and CISA added it to the Known Exploited Vulnerabilities catalogue the same day.

The operational significance of this campaign is not the exploit. It is that Lazarus has now converted kernel access from an opportunistic capability into a repeatable production line. This is the group’s second zero-day in the same default-present driver in twenty-four months, delivered through the same recruiter-lure ecosystem it has used since 2020, staged by the same in-memory loader documented in 2024, and finished by the same kernel rootkit family it has iterated since 2021. Around that stable core the group has changed the parts that defenders actually watch: the delivery pretext, the transport, and the infrastructure.

Three tradecraft changes deserve programme-level attention. First, the escalation loader negotiates its session key using ML-KEM (Kyber), a post-quantum key encapsulation mechanism, which removes any prospect of retrospective decryption of captured command-and-control traffic. Second, the kernel rootkit now tampers with Smart App Control and forces an in-place reload of code integrity policy, extending the group’s telemetry-teardown suite from detection evasion into platform trust subversion. Third, the group has abandoned owned infrastructure entirely in favour of a relay layer running on compromised legitimate webmail and content-management servers, and has reused a compromised victim in France to phish further targets.

For defenders, the practical consequence is that the traditional detection surface is being removed by design. Once the kernel rootkit executes, endpoint telemetry is not evaded, it is dismantled. Detection engineering must therefore move upstream of privilege escalation — to lure delivery, sideloading, and anomalous Microsoft Graph automation — and, downstream, to the absence of expected telemetry rather than the presence of malicious telemetry.

Confidence terms follow the standard analytic lexicon set out in Annex B. Judgements are analytic conclusions drawn from the observed reporting; they are not themselves observations.

KJ-6

We assess with moderate confidence that the adoption of post-quantum key encapsulation is a forward-looking counter-intelligence measure rather than a near-term operational necessity.

There is no present quantum threat to the classical key exchange it replaces. The change is best read as denying future retrospective decryption of archived collection — a harvest-now-decrypt-later defence applied by the offensive side. Its immediate practical effect on defenders is that captured C2 traffic will not become readable later.

This assessment addresses the modus operandi of the August 2026 wave of Operation Dream Job: how the operation selects and approaches targets, how it delivers and stages code, how it obtains and retains kernel-level control, and how it moves data. It is written for detection engineers, incident responders and security leaders in defence, aerospace and adjacent manufacturing supply chains. It is not an exhaustive malware analysis, and it does not attempt to reverse the exploit.

Sourcing is uneven and readers should hold that in mind throughout. The vulnerability itself is documented by the vendor of record, the national vulnerability registry and the national cyber defence authority, and is therefore firmly established. Everything else — the infection chains, the tooling, the infrastructure model, the victim set and the attribution — derives from a single research vendor’s disclosure published on 11 August 2026. That vendor’s prior work in this area has been reliable and its technical detail here is internally consistent and consistent with earlier independent reporting on the same tool families. It is nonetheless single-source, and this assessment grades it accordingly.

Two disciplines are applied throughout. First, observation is separated from inference: statements describing what reporting documents are written as observations, and statements describing what those observations imply are marked as assessments. Second, sources are graded on the Admiralty scale, in which the letter denotes source reliability and the numeral denotes information credibility.

Operation Dream Job is one of the longest-running and most consistently productive intrusion sets attributable to the Democratic People’s Republic of Korea. The designation originates with reporting published in August 2020 describing a DPRK campaign that approached employees of defence and aerospace firms with fabricated employment offers from well-known primes, using decoy job descriptions as the delivery vehicle. Parallel research published in the same period under different names described the same activity from different vantage points. The technique has survived six years with remarkably little modification, which is itself analytically significant: it works.

The activity is tracked as Lazarus Group under MITRE’s G0032 designation and as campaign C0022, with substantial overlap into vendor-specific clusters including UNC2970, Diamond Sleet and TEMP.Hermit. Those labels do not map cleanly onto one another and this assessment does not attempt to reconcile them; the practical point is that the tooling observed in this wave has appeared across several of those clusters, which is one reason the attribution is credible even though it rests on a single vendor.

The lineage relevant to this wave runs as follows. Defence and aerospace targeting from 2020 onward. A trojanised coding-challenge variant against a Spanish aerospace firm in 2023, delivered through professional social networking. A supply-chain compromise of a widely deployed communications client in the same year. In September 2024, reporting on an energy and aerospace campaign that introduced the MISTPEN in-memory loader delivered through a trojanised text-editor plugin. In October 2025, reporting on European unmanned-aerial-vehicle manufacturers that carried the ForestTiger implant and, notably, a build-path artefact bearing the string that would later name the Troy backdoor. The August 2026 wave sits directly in that line.

Observed versus inferred

Observed: reporting documents the campaign lineage above and the tool families named in each wave.

Inferred: that the same development team or an adjacent one is responsible across these waves. Shared build-path strings and near-identical rootkit code are strong indicators of shared tooling, but shared tooling within a state programme does not by itself prove a shared operational unit.

CVE-2026-68820 is a use-after-free defect in the Windows Ancillary Function Driver for WinSock, the kernel driver that backs the Windows sockets interface. Each socket carries a small kernel-resident state structure. Where a socket is created and then accessed concurrently by multiple threads, two internal code paths within the driver can operate on that same structure without synchronisation. The resulting race allows one path to reference memory that the other has already freed. The operator leverages that freed-memory reference to construct an arbitrary kernel read and write primitive, and from there elevates the running context to SYSTEM.

The driver is an unusually attractive target and its selection is very likely deliberate rather than opportunistic. It ships with every supported Windows build, so no delivery step is required. It is reachable from an ordinary unprivileged user context through the standard socket API, so the escalation is user-to-kernel rather than admin-to-kernel — a materially stronger primitive, because it does not require the operator to have already obtained administrative rights. And because the driver is already resident, exploitation avoids the entire bring-your-own-vulnerable-driver pattern, which in current environments means avoiding the vulnerable-driver blocklist, avoiding driver-load telemetry, and avoiding the signature and reputation checks that make BYOVD comparatively noisy.

This is the second zero-day this actor has burned in this specific driver in twenty-four months. The earlier one, disclosed in August 2024, was likewise a use-after-free and likewise delivered the same rootkit family. A third, unrelated use-after-free in the same driver was patched in November 2025 and attributed elsewhere. Three memory-safety defects of the same class in the same component within two years indicates a component with systemic concurrency weaknesses that is under sustained research attention from more than one party.

Assessment

We assess with moderate confidence that further undisclosed defects in this driver are likely to exist and that this actor is likely to be actively researching them. Defenders should not treat the August 2026 patch as closing the surface; they should treat kernel escalation from an unprivileged context as a standing assumption and invest accordingly in the layers above and below it.

The operation runs two delivery chains in parallel. They differ entirely in their front end and converge on a shared back end. This structure is the single most important thing to understand about the campaign, because it means a defence tuned to either chain alone will miss half the activity while producing a false sense of coverage.

Targeting is narrow and sector-specific: defence, aerospace, aviation, and the unmanned-systems and robotics suppliers around them. Individual selection appears to focus on engineering staff rather than executives or administrators, which is consistent with a collection objective centred on technical documentation rather than on financial access or broad network compromise.

The first pretext is the long-established recruiter approach. An operator-controlled persona contacts the target through a professional social network or a consumer messaging application and offers a position at a recognised prime contractor. A decoy job description referencing a well-known United States defence manufacturer was observed in this wave. The approach exploits a behaviour that no amount of phishing awareness training reliably suppresses, because engaging with a recruiter is a normal and career-rational act.

The second pretext is new to this wave and is analytically more interesting. Rather than impersonating an employer, the operators impersonated a real privacy-technology company, standing up multiple lookalike websites and promoting them through search engine optimisation to the point where some appeared among the top results for the legitimate company’s name. The impersonated company was neither compromised nor otherwise involved. This inverts the usual defensive advice. A user who follows good practice — declining links in unsolicited messages and instead searching for the vendor and downloading from the site they find — arrives at the operator’s infrastructure by the correct-looking route.

The victim receives an encrypted archive containing three items: a legitimate, validly signed PDF viewer executable; a malicious dynamic-link library named to match a genuine dependency of that viewer; and an encrypted payload presented as a PDF document. Encryption of the archive defeats gateway inspection and requires the victim to supply a password, which the operator provides in conversation — an act that also confirms victim engagement.

On execution the signed viewer loads the malicious library from its own directory in preference to the system copy. The library performs two functions simultaneously: it renders the decoy job description so the victim sees exactly what they expected, and it decrypts the accompanying payload and executes it in memory. Nothing malicious is written to disk beyond the initially delivered files, and the process tree shows a signed application behaving normally.

The second chain, observed from July 2026, removes the sideloading artefact entirely. Instead of shipping a malicious library alongside a clean viewer, the operators shipped a modified build of an open-source PDF viewer under a different product name, distributed through the impersonation sites described above.

The modification is precise. Two code paths in the viewer — the file-open dialogue handler and the drag-and-drop handler — were altered to inspect each opened document for a specific marker string. Ordinary documents render normally, which means the binary passes casual behavioural testing and can be used as a genuine PDF viewer indefinitely. When a document containing the marker is opened, the viewer extracts an embedded payload, decrypts it with a single-byte exclusive-or key, writes the result to the user’s temporary directory as an executable, and launches it as a child process. That executable in turn reflectively loads an embedded library carrying the Troy backdoor.

Detection consequence

Chain two defeats the two controls most organisations rely on against chain one. There is no sideloaded library, so image-load detections keyed on unexpected dependency paths do not fire. And because the trojanised viewer behaves correctly on all non-marked documents, sandbox detonation of the binary alone produces a clean verdict. Detection has to move to the trigger — an unexpected executable written to the temporary directory and spawned as a child of a document viewer — or to the acquisition, by treating installer provenance rather than installer behaviour as the control point.

Chain one terminates in MISTPEN, an in-memory loader first documented in 2024. It never touches disk after initial execution, loading its components reflectively. Its command-and-control transport is the significant design choice: it communicates through the Microsoft Graph API to a cloud storage account, exchanging encrypted files with separate keys for upload and download. From a network perspective this is indistinguishable from an employee synchronising documents, and in an environment that already permits access to that cloud service — which is to say, most enterprise environments — it produces no anomalous destination, no unusual protocol and no untrusted certificate.

The loader is modular. Four modules were observed in this wave: a host-profiling module reporting domain or workgroup membership, hostname, username and operating system build; an extended variant of the same that adds a process inventory with parent process identifiers, creation times and owning accounts; a desktop capture module returning screenshots as encoded images; and a privilege-escalation loader described separately below. The reconnaissance sequence is conservative and short, which is consistent with an operator prioritising avoidance of behavioural detection over collection breadth in the early access phase.

The escalation module does not carry the exploit. It fetches it, and it does so through a deliberately staged negotiation that shares a buffer with the loader for inter-component messaging. The sequence runs in four steps. First, the host is fingerprinted, including enumeration of installed security products — meaning the operator knows what is watching before the exploit is ever sent. Second, the module requests a set of public keys from the command-and-control server. Third, a session key is generated using ML-KEM, the standardised post-quantum key encapsulation mechanism. Fourth, the exploit payload is downloaded, decrypted with the negotiated key, and executed in memory through a named export. A further symmetric layer using a block cipher with a random session key, encoded and prepended to each packet, sits over the top.

Two operational consequences follow. The first is denial of retrospective decryption: an organisation that captures this traffic today, even in full, will not be able to recover the exploit or the session content later, whatever advances occur in cryptanalysis. The second, and more immediately damaging, is that the exploit is never present on the wire in a recoverable form and never present on disk at all. Defenders who obtain the traffic obtain nothing. This is a materially different posture from campaigns where the exploit can be extracted from a proxy capture.

Assessment

We assess with moderate confidence that the introduction of post-quantum key encapsulation is a counter-intelligence measure aimed at future exposure rather than a response to any present cryptographic threat. Its practical effect is to place a permanent floor under the intelligence value of intercepted traffic. Analytically, it also signals a development programme with the maturity and the time horizon to adopt standardised modern cryptography ahead of most of the enterprises it targets — a point worth making to leadership, because the same organisations that cannot yet inventory their own cryptographic dependencies are now facing an adversary that has already migrated.

Following successful exploitation the operators deploy the current iteration of a kernel rootkit family the group has maintained since approximately 2021. The version observed here is largely unchanged from the version documented in 2024, which is itself analytically useful: it means the substantial body of prior public research on that version remains applicable.

The retained capability set is best understood not as evasion but as demolition. Executed in sequence, it suppresses crash dump generation first — so that any instability introduced by subsequent operations produces no forensic artefact — then removes process, thread and image notification callbacks, removes object and registry callbacks, unloads filesystem minifilters by altitude band, and terminates the kernel logger. It carries a hardcoded kill-list of ninety-four event tracing provider identifiers, matching prior public documentation of the previous version almost exactly and in the same order. It includes a driver selection engine with a universal preserve list and per-class rules governing what to keep and what to disable, and a conditional network filtering stage that activates only when one specific security vendor’s product is present and another’s is absent. Privileged handle forgery and a two-hop process spawn through the service control manager into a SYSTEM-context installer process complete the toolkit.

Three deltas from the prior version are worth recording. The dedicated stage for disabling the platform’s own antimalware service has been removed, leaving only an orphaned diagnostic string where it used to run. The privilege-stripping stage targeting a specific Korean security vendor’s protected process has likewise been removed. And a new capability tampers with Smart App Control: it zeroes the policy state value and invokes a system information call with a specific class and option to force an in-place reload of the code integrity policy.

Why the Smart App Control change matters

The earlier stages of this rootkit blind the sensors. This one attacks the platform’s own judgement about what software is trustworthy. Removing callbacks stops the security stack from seeing what runs; subverting code integrity policy changes what the operating system will consent to run in the first place. That is a qualitative escalation from evasion to trust subversion, and it is the single change in this wave with the longest tail — because a host whose code integrity policy has been altered in place is not returned to a trustworthy state by removing the implant.

It also targets only current Windows 11 builds, as does the exploit module itself, which carries an explicit minimum-version check. This is a deliberate narrowing. Older builds are not attacked. The most plausible explanation is that the operators are protecting a valuable capability by restricting it to the environments they actually need it in, and accepting the cost of losing access on legacy estates rather than risking exposure on them.

Two terminal implants were observed. Chain one culminates in ForestTiger, a backdoor previously associated with this actor, alongside a second instance of the in-memory loader now running in an elevated context with kernel-level telemetry suppression already in place. Chain two culminates in Troy, a newly identified single-file backdoor.

Troy is a sixty-four-bit library implementing seventeen operator commands: keepalive, volume enumeration, directory listing, process creation with a hidden window, file and directory deletion, archived exfiltration with cleanup, chunked file download and upload, an interactive shell that tracks working-directory changes and enforces a watchdog timeout, reflective library injection into a remote process, process termination, one-shot and configured sleep intervals, configuration read and write, and process enumeration with and without command lines. It is configured with three command-and-control servers that it attempts in order, validating a fixed response string before proceeding, and authenticates through a challenge-response exchange. Registration reports a client identifier and a system profile. Tasking arrives base-64 encoded with plaintext prefix matching, and responses are returned in a small structured envelope, chunked when oversized.

The command set is unremarkable, and that is the observation worth recording. This is a competent, conventional, deliberately unexciting implant. The sophistication in this campaign is concentrated in delivery, escalation and infrastructure; the hands-on-keyboard tooling is ordinary. Defenders looking for the intrusion at the implant layer are looking in the least distinctive place.

The operators appear to own no infrastructure in this campaign. Command and control runs entirely through compromised legitimate servers: webmail installations, content management systems and e-commerce platforms belonging to unrelated third parties. Webmail hosts were compromised through a critical deserialisation vulnerability disclosed in mid-2025 that requires authentication, with credentials sourced from previously leaked datasets. At least seventeen distinct relay nodes were identified. Operator access to the relay layer was made through a commercial virtual private network service.

The webshell deployed on these hosts is not a conventional command-execution shell, and treating it as one will cause it to be missed. It is a message relay. A password submitted in a request selects one of two modes. In victim mode it establishes a session, decrypts an embedded configuration using a simple substitution cipher to recover an upstream address and a unique server identifier, and signals the new session upstream. In operator mode it exposes session management, connectivity checking, configuration update, log retrieval, file upload and self-deletion. Communication between the two sides is file-based: each side writes to its own log file within the session and reads the other’s, producing an asynchronous bidirectional channel in which the two parties are never connected to each other at the same moment.

Assessment

We assess with moderate confidence that this infrastructure model is intended primarily to defeat attribution and takedown rather than to defeat detection. Traffic to a compromised webmail server in an unrelated country is unremarkable in most enterprise egress; more importantly, the compromised host absorbs the investigative attention, the operator is never in direct contact with the victim, and no asset exists that can be seized or sinkholed. The reuse of a compromised organisation in France to phish subsequent targets is the same logic applied to the delivery side: borrowed reputation, in which the sender’s legitimacy is genuine and therefore cannot be revoked by the defender.

It is easy to read this campaign as a leap forward and easy to read it as more of the same. Both readings are wrong. The accurate reading is that a stable, well-understood core has been surrounded by changes precisely at the points where defenders had developed coverage.

The progression of kernel access across the last five years is the clearest illustration of the pattern.

The trajectory runs from loading a vulnerable third-party driver, to burning zero-days in built-in drivers, to burning a second zero-day in the same built-in driver. Each step reduces the number of observable events between initial execution and kernel control. The first model required a driver to be written to disk and loaded, which is loud. The current model requires nothing but a socket.

We assess it likely that this progression continues rather than reverses. The economics favour it: a built-in-driver zero-day is expensive to find but cheap to use repeatedly, produces almost no telemetry, and is not subject to the blocklisting that has steadily degraded the BYOVD approach. For defenders the implication is uncomfortable but clear — privilege escalation is becoming an unreliable place to detect this actor, and detection investment should be weighted toward the stages either side of it.

The named victim geography is France, Germany, Brazil and India, and the sector focus is defence and aerospace with particular emphasis on surveillance sensors, unmanned systems and robotics. The selection is coherent rather than opportunistic. Western European primes and their suppliers hold advanced sensor and airframe technology. Brazil and India both operate substantial and rapidly growing domestic aerospace industries with significant export activity and, in general, supply chains that are less hardened than those of their North American counterparts. Targeting the suppliers rather than the primes is the standard efficient path to prime-contractor technology.

Strategically, this activity sits on the collection side of the DPRK cyber programme and should be distinguished from the revenue side, even though both are directed by the same apparatus. Multinational sanctions monitoring reporting published in October 2025 assessed that the DPRK stole at least 1.19 billion United States dollars in cryptocurrency during 2024 — around a third of that year’s foreign currency income — and at least 1.65 billion in the first nine months of 2025, giving a total in the region of 2.8 billion dollars across more than forty operations in under two years. The same reporting identified DPRK information technology workers operating in at least eight countries, with the largest concentration in China. Earlier United Nations assessment placed cyber operations at roughly half of the state’s foreign currency income and a substantial share of the funding for its weapons programmes.

Dream Job does not generate revenue. It generates military technology. Organisations in the defence supply chain should therefore expect a different adversary posture than the one described in most DPRK reporting: patient, quiet, focused on document collection, and content to hold access for extended periods rather than monetise it. The tooling described in Section 6 is built for exactly that — in-memory execution, cloud-native transport, and a kernel implant whose purpose is to make long residence survivable.

Supply-chain implication for readers outside the named geographies

The four named countries reflect where the reporting vendor had visibility, not the boundary of the campaign. Any organisation holding sensor, avionics, unmanned-systems or robotics intellectual property — including tier-two and tier-three suppliers who do not consider themselves defence companies — falls inside the plausible target set. We assess it likely that the true victim count exceeds what has been published.

The following mapping is inferred from reported behaviour rather than supplied by the reporting vendor, and is offered as a starting point for coverage assessment rather than as an authoritative mapping.

T1090

Proxy

Relay-only webshell as asynchronous comms channel

Web log analysis

Recommendations are sequenced by decision urgency. The organising principle is that the middle of this attack chain — privilege escalation and kernel implantation — is the hardest place to detect and the easiest place to be blinded. Effort should be concentrated at the edges.

1. Deploy the August 2026 cumulative update across the Windows estate, prioritising current Windows 11 builds, which are the only builds this exploit targets. Legacy builds carry the vulnerability but are not being attacked by this actor; sequence accordingly if capacity is constrained.

2. Patch or isolate every webmail installation against the 2025 deserialisation vulnerability used to seed the relay layer. This is not only a defence against being targeted; it is a defence against being conscripted as infrastructure and inheriting the consequent legal and reputational exposure.

3. Ingest the published indicator set from the primary vendor appendix into endpoint and network controls. The subset reproduced in Section 12 of this assessment is partial and should not be treated as complete.

4. Confirm patch state on engineering workstations first, not on servers. The initial access vector is a human being with a technical role, not an exposed service.

— Hunt for a document viewer process spawning a child executable from the user temporary directory. This is the highest-value single behavioural detection for chain two and it is comparatively cheap to write.

— Hunt for dynamic-link libraries loaded from user-writable directories by signed document-handling applications, specifically where the library name matches a known dependency but the path does not match the installed product location.

— Baseline and then alert on Microsoft Graph API activity originating from processes that are not the sanctioned client applications. This is the detection with the widest applicability beyond this campaign, because cloud-native command and control is now the norm rather than the exception.

— Inspect internet-facing content management, e-commerce and webmail hosts for session files and paired per-session log files sharing a session identifier with differing numeric suffixes. Relay artefacts are file-based and therefore survive between operator sessions.

— Audit Smart App Control policy state and code integrity policy modification on current Windows 11 hosts. Treat unexplained in-place policy reload as a high-severity finding.

The rootkit’s design means that once it executes successfully, conventional detection has already failed. The residual detection opportunity is inverted: monitor for the disappearance of expected signal rather than the appearance of malicious signal.

— Alert on unexpected termination of the kernel logger session.

— Alert on filesystem minifilter unload events, particularly for security-product altitudes.

— Alert on endpoint agents that stop reporting while the host remains reachable on the network. A silent-but-alive host is the canonical signature of this toolkit and is detectable from the management plane even when the endpoint itself has been blinded.

— Alert on gaps in event tracing provider coverage where a provider present at boot ceases to emit without a corresponding service restart.

— Alert on process ancestry showing a system-context installer process spawned by the service control manager without an accompanying installation activity.

Guidance for leadership

The practical message for a security leader is that endpoint detection and response cannot be the last line of defence against this actor, because this actor’s rootkit specifically dismantles it. Resilience here comes from three things that sit outside the endpoint: rapid patch cadence on the escalation surface, network and identity telemetry that the endpoint implant cannot reach, and management-plane monitoring that treats sensor silence as an incident rather than as a maintenance nuisance.

Neither delivery chain is defeated by conventional phishing awareness training, and saying so plainly is more useful than repeating the advice. Chain one exploits legitimate career behaviour. Chain two specifically defeats the standard instruction to avoid links and search for the vendor instead. Two controls do work. The first is application allow-listing or provenance-based software control, which makes the question ‘where did this binary come from’ rather than ‘does this binary look malicious’. The second is a straightforward organisational norm that software used on corporate endpoints is obtained through a managed catalogue, coupled with a low-friction path for engineers to request additions — because the alternative is that they will download utilities from search results, which is precisely the behaviour this campaign monetises.

Three errors are present in early secondary coverage and in at least one widely circulated technical summary of this campaign. Readers who have ingested these into internal tracking should correct them.

Correction 1 — attribution of CVE-2021-1732

Several summaries place the 2021 win32k vulnerability in the lineage of DPRK kernel-access operations. It does not belong there. That vulnerability was a zero-day used by a different actor entirely, discovered and reported by a different research organisation, and is unrelated to this actor. The correct earliest anchor for this rootkit family’s kernel access is the 2021 third-party driver vulnerability referenced in Figure 1. Including the win32k vulnerability materially overstates the length and continuity of the actor’s zero-day history.

Correction 2 — the KEV remediation obligation

The vulnerability was added to the Known Exploited Vulnerabilities catalogue on 11 August 2026, but the entry does not impose a fixed two-week federal deadline. Under the binding operational directive issued in June 2026, fixed calendar due dates were replaced with risk-based remediation, and the catalogue action field now directs agencies to remediate in accordance with vendor instructions under that directive. Organisations that mirror federal timelines in their own policy should verify what their internal standard actually references before citing a deadline that no longer exists in that form.

Correction 3 — unverified disclosure sub-dates

The report-to-patch interval of fourteen days is well supported: the vulnerability was reported to the vendor on 28 July 2026 and patched on 11 August 2026. The intermediate dates circulating in some summaries — vendor confirmation on 31 July and identifier assignment on 5 August — could not be corroborated against any accessible primary source and are carried in this assessment as unverified. They are plausible and may well appear in the primary disclosure narrative, but they should not be presented as established fact in derivative reporting.

The following indicators are reproduced from public reporting available at the information cut-off. This set is partial. The primary vendor published a fuller indicator appendix and a detection rule for the relay webshell; those should be retrieved directly from the vendor and used in preference to this table for any enforcement action. Note also that some rule content circulating in association with this campaign is third-party authored rather than vendor authored, and should be validated before deployment.

Indicators of this kind have short operational lives, particularly the network indicators, since the relay layer consists of third-party hosts that may be remediated or replaced at any time. They are provided for retrospective hunting and for immediate blocking, not as a durable control. Behavioural detections described in Section 10 will outlast them.

The following gaps constrain confidence in this assessment. They are stated so that readers can weight the judgements appropriately and so that collection can be directed against them.

— Independent corroboration of attribution. No second research organisation had corroborated the actor attribution at the information cut-off. Corroboration would raise KJ-2 to high confidence.

— True campaign scope. The victim set reflects one vendor’s visibility. Whether victims exist outside the four named countries, and whether sectors adjacent to defence were also targeted, is unknown.

— Initial access to the relay layer. The webmail compromise route is documented, but how the content management and e-commerce hosts were compromised is not.

— Exploit reliability and pre-patch dwell. How long the vulnerability was in operational use before July 2026, and how reliably the race condition can be won in practice, are both unknown. The exploit module compilation timestamp of 7 July 2026 establishes a floor, not a start date.

— Relationship between the two chains. Whether the chains are run by the same operational team against different target profiles, or represent parallel teams, is not established.

— Post-exploitation objectives. No reporting describes what was actually collected from victims. The absence of exfiltration detail is a substantial gap for any organisation attempting to assess impact.

We assess it very likely that this actor continues defence-sector collection through recruiter-pattern access for at least the next twelve months, and likely that further trojanised legitimate utilities appear within two quarters. We assess it likely that the relay-only infrastructure model spreads to other DPRK clusters, since it is cheap, effective and requires no capability the group does not already have.

The following developments would change this assessment and should be treated as triggers for re-evaluation rather than as routine news.

— Publication of a working proof-of-concept for the vulnerability. None existed at the cut-off. Publication would move the exploit from a state-actor capability to a commodity one within days and would require the patch service-level agreement to be escalated from prioritised to emergency across the whole estate.

— Independent reporting of victims outside the four named countries or outside the defence sector. This would indicate either broader targeting than assessed or a second actor using overlapping tooling.

— Observation of the same escalation chain delivered by a different initial access vector — for example through an exposed service rather than a lure. This would indicate the capability has been shared beyond the team that developed it.

— A further afd.sys defect exploited in the wild by this actor. This would confirm sustained dedicated research against the component and would justify treating unprivileged-to-kernel escalation as a permanent assumption in threat models.

— Adoption of post-quantum key exchange by other state clusters. This would mark the point at which retrospective decryption of intercepted command-and-control traffic ceases to be a viable analytic technique against advanced actors generally.

This assessment applies four standards consistently, and readers are entitled to hold it to them.

— Observation and inference are separated. Descriptions of what reporting documents are written as observations. Conclusions drawn from those observations are introduced as assessments and carry an explicit confidence level.

— Sources are graded. The Admiralty scale is applied in Section 3, with the letter denoting source reliability and the numeral denoting information credibility. Single-source material is identified as such wherever it carries a judgement.

— Confidence language is standardised. Probability and confidence terms follow the lexicon in Annex B and are not used loosely elsewhere in the text.

— Gaps are stated rather than smoothed. Where a claim could not be corroborated it is marked unverified rather than omitted or asserted. Section 13 records what is not known.