Lazarus Zero-Day: False Job Offers Take Aim at Defense Engineers

How the fake Lockheed Martin job offer lures defense engineers

The North Korean state-sponsored hacking group Lazarus has revived one of its signature tactics, luring victims with fake job offers, but this time paired with a previously unknown Windows vulnerability. According to reporting on the campaign, attackers are posing as recruiters from Lockheed Martin, one of the world's largest defense contractors, to reach engineers working in the aerospace and defense sector.

The approach follows a familiar Lazarus playbook known as Operation Dream Job. A target receives what looks like a legitimate recruitment message, often referencing a specific role, project, or technical specialty relevant to their career. Because the outreach is tailored and professionally written, it can be difficult to distinguish from a genuine hiring inquiry. Once the victim engages, a booby-trapped file or link delivers the malicious payload, and that payload is where this campaign turns from a routine phishing lure into a serious technical threat.

What CVE-2026-68820 lets Lazarus do once inside a network

The vulnerability at the center of this campaign is tracked as CVE-2026-68820, a Windows zero-day that was being actively exploited before a patch existed. A zero-day flaw is especially dangerous precisely because there is no fix available at the time attackers start using it, meaning traditional patching schedules offer no protection until vendors catch up.

Once Lazarus operators trick a defense engineer into opening the malicious content, the exploit reportedly interacts with a core Windows driver component, allowing the attackers to escalate privileges and gain deeper access to the compromised machine. In practical terms, this means a single click on a fake job attachment can hand attackers a foothold that goes well beyond standard user permissions, potentially exposing sensitive files, credentials, and internal network access. Earlier coverage detailing how Lazarus Group uses this Windows zero-day in a fake job scam walks through the technical mechanics of how the exploit chain unfolds after the initial lure succeeds.

Why this campaign targets the defense and aerospace supply chain

Defense and aerospace organizations are attractive targets for state-sponsored groups like Lazarus because they sit at the intersection of valuable intellectual property and national security interests. Engineers working on defense programs often have access to proprietary designs, classified project details, or systems connected to broader government and military networks. A successful compromise at a single engineering workstation can become a stepping stone into a much larger supply chain, affecting contractors, subcontractors, and government partners alike.

This is not the first time this specific zero-day has surfaced in connection with defense sector targeting. Related reporting on how the Operation Dream Job zero-day hit defense and aerospace firms shows that Lazarus has been running variations of this campaign against similar targets for some time, refining both the social engineering lure and the technical exploit along the way. The persistence of these efforts suggests attackers view the defense sector as a long-term, high-value target rather than a one-off opportunity.

Defensive steps: credential hygiene, segmentation, and secure remote access

The good news is that Microsoft has already addressed CVE-2026-68820 through a security update, and organizations that have applied the relevant patch are protected against this specific exploit. Detailed technical background on the flaw itself, including how it affects the AFD.sys driver on Windows 11 systems, is available in the writeup on how Lazarus hits the Windows 11 AFD.sys driver.

Beyond patching, this campaign is a reminder that technical fixes alone will not stop a determined social engineering effort. Organizations in the defense and aerospace space should reinforce basic but often overlooked practices: verifying recruiter outreach through official company channels before opening any attachments, segmenting corporate networks so that a single compromised workstation cannot easily reach sensitive systems, and requiring secure, authenticated remote access rather than relying on ad hoc file sharing. IT teams should also ensure employees connecting from home or while traveling use properly configured VPNs and multi-factor authentication, reducing the chance that a compromised endpoint can quietly pivot into broader company infrastructure.

What This Means For You

If you work in engineering, defense, or aerospace, and you receive an unsolicited job offer, even one that looks polished and references real companies like Lockheed Martin, treat it with caution before opening any attached files. Confirm the opportunity through the company's official careers page or a known contact rather than replying directly to the message. For IT and security teams, this Lazarus zero-day fake job offer campaign underscores why timely patching, network segmentation, and strict remote access controls need to work together, since no single layer of defense is enough on its own.

For step-by-step guidance on confirming your systems are protected, the patch advisory covering Lazarus Group's Windows zero-day CVE-2026-68820 walks through what defense-sector IT teams should check right now.

Actionable Takeaways

• Verify any unexpected recruiter contact through official company channels before opening attachments or clicking links.
• Confirm your organization has applied Microsoft's patch for CVE-2026-68820 across all Windows endpoints.
• Segment networks so a single compromised device cannot easily reach sensitive defense or engineering systems.
• Require secure, authenticated VPN access and multi-factor authentication for all remote connections.
• Train engineering and technical staff specifically on Operation Dream Job style lures, since this tactic has repeatedly succeeded against skilled, technically savvy employees.