Front Page

Nation-State

Job Offer, Zero-Day, Backdoor: Lazarus Exploits an Unpatched Windows Driver Flaw to Plant a New Implant Called Troy

Researchers this week detailed an Operation Dream Job wave in which North Korea's Lazarus Group used fake job-offer lures against employees at defense and aerospace firms in France, Germany, Brazil, and India, then escalated privileges through a previously unknown flaw in the Windows Ancillary Function Driver (AFD.sys), tracked as CVE-2026-68820. The exploit chain delivered ForestTiger, a loader Lazarus has used before, alongside a newly identified backdoor called Troy — the group's first documented use of this implant.

AFD.sys mediates nearly all Winsock socket operations, so a privilege-escalation bug there hands an attacker kernel-level reach from a low-privileged foothold with no user interaction beyond opening the initial lure document. Forensic priority: hunt for anomalous AFD.sys IOCTL call patterns and unexpected privilege transitions in kernel event logs, capture memory before remediation since Troy's persistence mechanism is not yet fully cataloged, and treat any defense-sector employee who received an unsolicited recruiter contact in the past month as a potential initial-access vector requiring inbox and endpoint review.

Supply Chain

Two Hours to Patch Zero: A Typosquatted Rust Crate Turned 245 Million Downloads Into a Build-Time Backdoor

On August 20, an attacker published malicious versions of three popular Rust crates — arrayref, internment, and append-only-vec, together downloaded roughly 245 million times — each carrying a single added manifest line pulling in proc-macro1, a typosquat of the ubiquitous proc-macro2 crate. Because proc-macro1's build script downloaded and executed a remote payload during compilation, simply building a project that resolved the dependency was enough to run the malware; nothing in the crates themselves had to be imported or called. The Rust Security Response Team pulled all three packages within 86 to 107 minutes of the first report, and researchers have since linked the publishing infrastructure to North Korea-linked group UNC1069.

The attack is a build-time variant of the same trust exploitation seen in npm and PyPI incidents, but compiled-language ecosystems make detection harder — a backdoored build script leaves no trace in the resulting binary for static analysis to catch after the fact. Forensic priority: audit Cargo.lock files for the affected version strings (arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9) and for any dependency on proc-macro1, inspect CI/CD build logs from August 20 for outbound connections during compilation, and rebuild from clean lockfiles on any host that resolved the poisoned dependency tree that day.

Threat Bulletin

CRITICAL
CVE-2026-65400

Apple macOS — an improper-authentication flaw in Screen Sharing lets a remote attacker bypass credential checks and gain interactive access to a target Mac; CVSS 9.8. Added to CISA KEV on August 18. Forensic Note: Review Screen Sharing (VNC/ARD) connection logs for sessions from unrecognized source IPs, check com.apple.screensharing launch daemon activity, and patch to the current macOS security update immediately — no workaround exists for internet-facing hosts.

ACTIVE EXPLOIT
CVE-2026-8037

Progress Kemp LoadMaster — a flaw in the load balancer's management interface allows unauthenticated remote command execution. CISA logged 792 exploit attempts across 65 source IPs over 41 days before the KEV addition. Forensic Note: Inventory internet-facing LoadMaster management interfaces, review appliance access logs for the attempt window, and treat any LoadMaster reachable from the open internet as compromised until artifact review proves otherwise.

Malware Spotlight

Amnesia Stealer — The macOS Malware That Watches You Work

Amnesia Stealer is a new macOS credential and cryptocurrency thief that pulls data from 16 Chromium-based browsers, iCloud Keychain, and wallet applications — standard stealer territory. Its distinguishing feature is a built-in Chrome DevTools Protocol client: once a browser session is compromised, the operator receives a live screencast running at roughly 3 frames per second and can drive the authenticated session with a full input set, turning a credential theft tool into an interactive session-hijacking platform. Forensic Note: Hunt unexpected processes holding open CDP debug ports (typically 9222) on macOS endpoints, review Keychain access logs for bulk enumeration events, and treat any authenticated banking or SSO session active during a suspected infection window as fully compromised, not merely "credentials exposed."