Microsoft patches 421 bugs; active Lazarus attack

TL;DR: Microsoft released a massive patch of 421 vulnerabilities, one actively exploited by North Korea's Lazarus group. The attack, targeting the defense sector, combines social engineering and an advanced rootkit. Apply patches immediately.

What happened

On August 11, Microsoft released its monthly security update (Patch Tuesday) fixing 421 vulnerabilities in its products. Although not a record, it is a high number reflecting the growing complexity of the software ecosystem. The most relevant news is that one of these flaws, identified as CVE-2026-68820, had already been exploited as a zero-day by the Lazarus group, linked to North Korea.

The vulnerability resides in the Windows auxiliary function driver for WinSock (afd.sys) and allows a local attacker to execute code with SYSTEM privileges. Microsoft describes it as a use-after-free issue that can trigger a race condition. Check Point Research, which reported the flaw, observed attacks since early June.

Why it matters

This incident underscores several critical trends in cybersecurity. First, the sophistication of state-sponsored actors: Lazarus not only exploits the vulnerability but has developed a new backdoor called Troy and an updated version of the FudModule rootkit. Second, the evolution of social engineering campaigns: attackers create fake websites that imitate legitimate companies (such as Lockheed Martin or Enveil) and use SEO techniques to position them in top search results, increasing their credibility.

Furthermore, the 421-patch figure reflects the impact of artificial intelligence on vulnerability discovery: AI tools allow finding flaws faster, but also make it easier for attackers to discover and exploit weaknesses. This volume of fixes can overwhelm corporate IT teams, which must prioritize which patches to apply first.

Consequences for businesses and users

For organizations, especially those in the defense sector and those with sensitive information, this attack is a wake-up call. The Operation Dream Job campaign, dating back to 2020, demonstrates that cybercriminals are willing to invest time and resources in targeted attacks. Companies must strengthen their security measures, including multi-factor authentication, network segmentation, and monitoring for suspicious activity.

For individual users, it is crucial to keep systems updated and be skeptical of job offers that seem too good to be true. Social engineering remains the most effective entry vector, even against victims with technical knowledge.

What readers should know

First, apply security patches as soon as possible, especially the one fixing CVE-2026-68820. Microsoft has classified exploitation as "more likely" for another vulnerability (CVE-2026-62832), so pay attention to updates. Second, be cautious with job websites: verify the authenticity of offers and URLs before clicking. Finally, understand that cybersecurity is a continuous process, not a one-time event.

"This attack demonstrates that state actors are constantly innovating, combining technical vulnerabilities with social engineering tactics to achieve their goals."

Historical context

Lazarus has been responsible for some of the most notorious cyberattacks in history, such as the Sony Pictures hack in 2014 and the WannaCry ransomware in 2017. This new attack shows that the group remains active and evolving, now focusing on intellectual property theft and surveillance. The collaboration between Microsoft and Check Point to attribute the attack is an example of how the industry unites against these threats.

Final recommendations

Update all Windows systems with the August patches immediately.
Implement security tools that detect rootkits and backdoors.
Train employees on how to identify fraudulent job offers.
Monitor network logs for unusual activities.
Consider network segmentation to limit lateral movement.