Check Point Research disclosed on August 12, 2026 that Lazarus Group had been exploiting CVE-2026-68820 — a use-after-free race condition in the Windows AFD.sys WinSock driver — since early July. The vulnerability gives the attacker a kernel read/write primitive from a local position, which Lazarus used to elevate to SYSTEM and load an updated version of their FudModule kernel rootkit. Microsoft patched the flaw in August Patch Tuesday (August 11, 2026). Any endpoint that has not applied this month’s updates is still at risk.

FudModule has appeared in previous Lazarus campaigns, but the August 2026 variant introduces updated support for Windows 11 builds 26100 and 26200, making it relevant to current enterprise endpoints. The rootkit’s primary function is to disable endpoint detection tools by manipulating kernel data structures — specifically handle tables — to remove the process handles that security software uses to monitor system activity.

This guide covers the detection logic you need before FudModule executes and after, with Sigma rules and KQL queries targeting each stage of the attack chain.

The FudModule Attack Chain

Understanding what to detect requires mapping the full sequence:

  1. Initial access: Lazarus delivers MISTPEN via trojanised PDF software in fake job offer emails targeting defence, aerospace, and UAV sector employees
  2. MISTPEN execution: In-memory loader establishes foothold; loads the LPE module
  3. CVE-2026-68820 exploitation: Race condition in AFD.sys triggered to obtain kernel read/write; privilege escalated to SYSTEM
  4. FudModule load: Kernel rootkit loads with SYSTEM privileges; targets handle tables of EDR/AV processes
  5. Handle table manipulation: FudModule removes or invalidates kernel object handles held by security processes, effectively blinding them
  6. Payload delivery: ForestTiger backdoor or Troy implant deployed; C2 via hijacked Roundcube webmail through RelayShell PHP web shell

Detection opportunities exist at stages 1, 2, 3, and 4 — after stage 4, your EDR may have lost visibility. Stage 1 (phishing) is a people and email security problem. The following rules target stages 2, 3, and 4 from the host telemetry perspective.

Detecting MISTPEN Loader Activity

MISTPEN executes as an in-memory loader spawned from trojanised PDF reader processes. Look for unexpected child processes from PDF applications and PDF viewers writing executables or DLLs.

Sigma — Suspicious Child Process from PDF Viewer:

title: Suspicious Child Process Spawned from PDF Application
id: 8f2a3c11-9e47-4b6d-a8c3-1d2f5e7b9a4c
status: experimental
description: Detects unusual child processes spawned from PDF viewer applications, consistent with MISTPEN delivery via trojanised PDF software
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\AcroRd32.exe'
      - '\Acrobat.exe'
      - '\FoxitPDFReader.exe'
      - '\PDFXEdit.exe'
      - '\SumatraPDF.exe'
    Image|endswith:
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\powershell.exe'
      - '\cmd.exe'
  filter_main_legitimate:
    CommandLine|contains:
      - '/S /uninstall'
      - 'AcrobatUpdater'
  condition: selection and not filter_main_legitimate
falsepositives:
  - PDF-based automation tools with legitimate subprocess invocation
level: high
tags:
  - attack.execution
  - attack.t1566.001
  - attack.t1204.002

Detecting CVE-2026-68820 Exploitation Indicators

The exploit races two threads accessing WinSock socket state. The kernel crash or corruption event that precedes successful exploitation may be visible in system logs. More reliably, look for the privilege escalation outcome: a non-SYSTEM process suddenly acquiring SYSTEM token privileges.

KQL — Sudden SYSTEM Token Acquisition (Microsoft Sentinel / Defender XDR):

// Detect processes acquiring SYSTEM-level privileges from non-SYSTEM parent
// Requires DeviceProcessEvents with token integrity level logging
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessIntegrityLevel != "System"
| where ProcessIntegrityLevel == "System"
| where InitiatingProcessFileName !in~ (
    "services.exe", "wininit.exe", "smss.exe", "csrss.exe",
    "lsass.exe", "svchost.exe", "winlogon.exe"
)
| project Timestamp, DeviceName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, FileName, ProcessCommandLine,
          InitiatingProcessIntegrityLevel, ProcessIntegrityLevel
| order by Timestamp desc

KQL — AFD.sys Driver Anomalous Kernel Activity:

// Look for unusual socket-related kernel exceptions or crashes following AFD activity
// Correlates with CVE-2026-68820 race condition exploitation timing
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType in ("KernelCallbackBlocked", "KernelExceptionCaught")
| where AdditionalFields contains "afd.sys" or AdditionalFields contains "AFD"
| project Timestamp, DeviceName, ActionType, AdditionalFields, InitiatingProcessFileName
| order by Timestamp desc

Detecting FudModule Kernel Driver Loading

FudModule installs as a kernel driver. The driver load event is one of the most reliable detection points — it must occur before FudModule can manipulate kernel handle tables.

Sigma — Unsigned or Suspicious Kernel Driver Load:

title: FudModule-Pattern Kernel Driver Load from Unusual Path
id: 2c4e8a17-f3b9-4d2a-9c7e-5a1b3f8d2e6c
status: experimental
description: Detects kernel driver loading from non-standard paths with revoked or unusual signing certificates, consistent with FudModule and similar BYOVD rootkit delivery
logsource:
  category: driver_load
  product: windows
detection:
  selection_path:
    ImageLoaded|startswith:
      - 'C:\Users\'
      - 'C:\ProgramData\'
      - 'C:\Temp\'
      - 'C:\Windows\Temp\'
  selection_unsigned:
    Signed: 'false'
  selection_revoked:
    SignatureStatus: 'Revoked'
  condition: selection_path or selection_unsigned or selection_revoked
falsepositives:
  - Legitimate kernel drivers installed to non-standard locations by some software
  - Drivers with expired (not revoked) certificates from legacy software
level: high
tags:
  - attack.defense_evasion
  - attack.t1014
  - attack.t1068

KQL — Kernel Driver Load from Non-System Path:

// Detects kernel driver loads from paths outside System32/Drivers
// FudModule loads from unusual paths; legitimate drivers load from system paths
DeviceImageLoadEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "System"
| where not (FolderPath startswith @"C:\Windows\System32\drivers"
          or FolderPath startswith @"C:\Windows\SysWOW64\"
          or FolderPath startswith @"C:\Program Files"
          or FolderPath startswith @"C:\Program Files (x86)")
| where FileName endswith ".sys"
| project Timestamp, DeviceName, FolderPath, FileName, SHA256,
          InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Detecting Handle Table Manipulation

FudModule’s core capability is manipulating kernel handle tables to remove security process handles. This is harder to detect directly at user mode, but the observable consequence — EDR or AV processes losing monitoring capability — is detectable through process behaviour changes.

Sigma — Security Tool Process Terminated by Non-Standard Process:

title: Security Product Process Terminated from Unexpected Parent
id: 7b9d4f21-a2c3-4e8b-b1d7-3f5a9c2e4b8d
status: experimental
description: Detects termination of security product processes from unexpected parent processes, which may indicate FudModule or other BYOVD tools terminating EDR/AV at kernel level
logsource:
  category: process_termination
  product: windows
detection:
  selection_target:
    Image|contains:
      - '\MsSense.exe'
      - '\MsMpEng.exe'
      - '\CSFalconService.exe'
      - '\CSFalconContainer.exe'
      - '\bdservicehost.exe'
      - '\SentinelAgent.exe'
      - '\SentinelServiceHost.exe'
      - '\CylanceSvc.exe'
      - '\cb.exe'
  filter_legitimate:
    ParentImage|endswith:
      - '\services.exe'
      - '\wininit.exe'
      - '\msiexec.exe'
  condition: selection_target and not filter_legitimate
falsepositives:
  - Legitimate security product upgrades or uninstallers
  - Administrative security tool management
level: critical
tags:
  - attack.defense_evasion
  - attack.t1014
  - attack.t1562.001

Detecting Troy and ForestTiger C2 Activity

Post-FudModule, Lazarus deploys Troy or ForestTiger. Both backdoors communicate via hijacked legitimate sites (Roundcube webmail, WordPress/PrestaShop) using the RelayShell PHP web shell as a relay. The C2 pattern involves HTTP/HTTPS to legitimate-appearing domains with file-based message queuing on the relay server.

KQL — Outbound HTTP to Known Email/CMS Platforms at Unusual Frequency:

// Detects high-frequency or pattern-repetitive HTTP connections to webmail/CMS
// that may indicate RelayShell C2 relay traffic
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort in (80, 443)
| where RemoteUrl has_any ("roundcube", "webmail", "/webmail/")
    or (RemoteUrl contains "wp-content" and RemoteUrl endswith ".php")
| summarize ConnectionCount = count(), 
            UniqueIntervals = dcount(bin(Timestamp, 5m))
            by DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName
| where ConnectionCount > 20 and UniqueIntervals > 5
| order by ConnectionCount desc

Indicators of Compromise

Check Point Research published technical IOCs from the August 2026 campaign. Key static indicators to hunt:

  • SHA-256 hashes for MISTPEN, Troy, and ForestTiger variants in the Check Point report
  • Network connections to hijacked Roundcube instances (identified infrastructure in the report)
  • The specific IOCTL codes used by FudModule to interact with kernel objects (for memory forensics)
  • Presence of processes with anomalously low handle counts immediately after a SYSTEM-privilege acquisition event

Patching Priority

CVE-2026-68820 is patched in August 2026 Patch Tuesday. Prioritise this update on endpoints in defence, aerospace, aviation, and UAV supply chain organisations — these are Lazarus’s confirmed targeting profile for Operation Dream Job. Endpoints running Windows 11 builds 26100 and 26200 are specifically confirmed as targeted by the updated FudModule variant.

Apply the patch. Do not rely solely on the detection logic above for protection against a kernel-level rootkit — detection becomes substantially harder once FudModule has loaded and removed EDR visibility.