A zero-day in the Windows WinSock kernel driver was actively exploited for five weeks by North Korea's Lazarus Group, which used it to install a rootkit that disabled 94 security channels. The patch is out — but do you understand what happened and how to prevent a repeat?
On 11 August 2026, Microsoft released its monthly patch cycle with fixes for 421 vulnerabilities, three of which qualified as zero-days. One of those three — CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver for WinSock, or afd.sys — had already been actively exploited for five weeks by the Lazarus Group, the North Korean state actor responsible for targeted attacks on defence contractors, financial institutions, and aviation organisations. The patch is available. The question that matters now is whether your environment has it, and whether it is already too late.
The vulnerability resides in afd.sys, the kernel driver that forms the backend of the Windows Sockets API — the layer used by virtually every networked application on Windows. Via a race condition in the driver's write handler, a locally authenticated attacker can escalate their privileges to SYSTEM, the highest privilege level in Windows. The CVSS score is 7.0. Exploitation requires local access rather than a remote connection — but in the context of the campaign Lazarus ran, that local threshold was easily reached through phishing.
Check Point Research reported the vulnerability to Microsoft on 28 July. By that point, the FudModule payload already carried a compilation timestamp of 7 July 2026 — meaning the attack had been running for at least three weeks before the disclosure, and five weeks before the patch.
Once privilege escalation to SYSTEM is achieved, Lazarus loads FudModule v3.1 into the kernel — an evolved version of the rootkit the group has deployed before and has been actively developing. FudModule erases itself from the list of loaded kernel modules and sabotages its own registration, making detection via standard module enumeration impossible.
More concretely: FudModule v3.1 disables more than 90 ETW providers. ETW, Event Tracing for Windows, is the telemetry infrastructure that modern EDR solutions rely heavily on for behavioural detection. Without ETW events, an EDR has no basis on which to observe malicious behaviour. The rootkit also deactivates minifilters — the hooks security software uses to intercept file system operations — and silences the NT Kernel Logger, the central telemetry aggregator that writes audit events to Windows Security. The result: 94 security channels effectively blinded. An attacker who installs FudModule can operate largely unimpeded while the EDR, SIEM, and audit log remain silent.
The Lazarus campaign follows a pattern the group has been refining for years. Step one: an employee in the defence or aviation sector receives a targeted message thread on LinkedIn, ostensibly from a recruiter or business partner. The contact leads to a fake job interview in which technical documents or project files are exchanged. Those files contain a stager that delivers initial access to the system.
Step two: with that access, the attacker executes CVE-2026-68820 to escalate to SYSTEM. Step three: FudModule v3.1 is loaded into the kernel. Step four: the attacker has persistent, near-invisible access to the system and can exfiltrate high-value data, plant backdoors, or move laterally to other systems in the network. Confirmed target sectors include defence, aerospace, and civil aviation, with registered activity across Europe, India, and Brazil.
The August 2026 Patch Tuesday update closes CVE-2026-68820 by correcting the race condition in the write handler of afd.sys. The fix is included in the cumulative updates rolled out on 11 August via Windows Update, WSUS, and the Microsoft Update Catalog. Verify via PowerShell using Get-HotFix, sorted by install date, that the most recent cumulative update is present. Systems still running the July baseline are vulnerable.
If your organisation runs a monthly patching cycle that extends to the end of the month, accelerating deployment is warranted when an actively exploited zero-day from a state actor is involved. Discuss with your management team whether emergency patching on critical workstations — particularly in defence, engineering, and aviation — is feasible.
The patch closes the kernel gap, but if FudModule was already active on a system before the patch was applied, patching alone is insufficient. Five additional measures IT teams should verify now.
First, Hypervisor-Protected Code Integrity (HVCI). HVCI blocks the loading of unsigned kernel drivers and makes FudModule variants significantly harder to place. Windows 11 has HVCI enabled by default on supported hardware; check its status under Device Security in the Windows Security Center. On systems without HVCI, enabling it is an immediate priority.
Second, Credential Guard and LSA Protection. Because the rootkit also facilitates credential theft after gaining kernel access, Credential Guard and the Protected Users Security Group deserve priority for accounts with elevated privileges.
Third, monitor ETW telemetry for anomalies. EDR solutions affected by a FudModule infection see a sudden quiet period: unusually low event volumes or the complete disappearance of specific ETW providers. Configure alerts for abnormal ETW provider unregistrations or unexpected silences in kernel events within your SIEM or via Defender Advanced Hunting.
Fourth, restrict local execution on sensitive workstations. Microsoft Defender Application Control and AppLocker, configured via Intune policy, reduce the likelihood that a stager delivered through a fake document or file is actually executed. An employee in the defence sector who opens a LinkedIn file need not have the ability to launch arbitrary binaries.
Fifth, audit antivirus exclusion lists. Lazarus campaigns have historically exploited AV exclusions that IT teams configured for performance reasons. A regular audit of unnecessary exclusions in Defender policy shrinks this attack surface.
The most troubling aspect of CVE-2026-68820 is not the vulnerability itself but the detection gap. Lazarus exploited the flaw from 7 July; the patch arrived on 11 August — five weeks. During that window, compromised systems were theoretically monitored by EDR software that the rootkit had effectively blinded.
This is a structural problem with advanced kernel rootkits that manipulate ETW. The lesson for IT teams is twofold. Patch speed is critical for actively exploited zero-days: a standard monthly cycle is not fast enough when a state actor has already been running an attack wave for weeks. And detection must never depend on a single channel: combining network telemetry, host behavioural analysis, and out-of-band logging increases the chance of detecting what a rootkit tries to hide.
CVE-2026-68820 is patched. But organisations that now take action to assess their kernel security posture, enable HVCI, and test their detection strategy are better positioned when the next campaign begins — and it will. Want to assess your Windows security posture, validate your EDR configuration against kernel-level attacks, or implement a patching process that lets you respond faster to zero-days? Contact Zarioh.
Zarioh Digital Solutions
IT specialists from Utrecht, the Netherlands. We help businesses with Microsoft 365, AI agents, hosting and telephony — and share what we learn in practice. Follow us on LinkedIn
