Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day

Check Point Research disclosed that North Korea’s Lazarus group ran an active campaign (Operation Dream Job) targeting defense and aerospace organizations across Europe, India and Brazil, exploiting a Windows kernel zero-day (CVE-2026-68820) to deliver an in-memory downloader (MISTPEN) which negotiated a Kyber post-quantum key exchange and fetched a kernel rootkit (FudModule v3.1); operators relied on compromised Roundcube/PrestaShop servers hosting a RelayShell PHP relay, trojanized vendor-impersonating sites, and delivered a new backdoor called Troy.