Today’s digest keeps circling back to one theme: the human in the loop is still the easiest way in, and the patch that closes one door doesn’t always close the whole hallway. Two nation-state groups ran recruiting scams to get a foothold this week, a vendor patch got bypassed within days of shipping, and a critical hypervisor management flaw is already being exploited across dozens of countries. Here’s what changed since yesterday’s digest.
Nation-state watch: Lazarus ran a Windows kernel zero-day for five weeks through fake defense-sector job offers before yesterday’s patch closed it
Attribution is in on the WinSock zero-day patched in Tuesday’s rollout: North Korea’s Lazarus Group exploited CVE-2026-68820 — the afd.sys use-after-free — for roughly five weeks before Microsoft shipped a fix, as part of a continuation of the long-running Operation Dream Job campaign. The lure is a fake recruiting process for defense, aerospace, and aviation roles, with confirmed targeting across France, Germany, Brazil, and India. Victims who engage are pushed toward a malicious launcher that reflectively loads a newly documented backdoor called Troy — 17 commands covering file exfiltration, an interactive shell, process injection, and process termination — or, in a second infection chain, a trojanized PDF viewer that triggers Troy in memory once it finds a hidden marker in an opened file. Some intrusions escalated further, deploying the FudModule rootkit to blind security tooling. CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog, giving federal agencies a two-week remediation window. Bleeping Computer · SecurityWeek
If your organization touches defense, aerospace, or aviation supply chains, this is more than a patch item: it’s a HR-process item. Brief recruiters and hiring managers on the Operation Dream Job pattern — unsolicited outreach for a well-known company’s role, a push off the official career site and onto a personal chat channel, and a “technical assessment” file to run locally. Confirm CVE-2026-68820 is patched everywhere, and if you have any reason to believe a defense-adjacent employee engaged with an unsolicited recruiter in the last month, hunt for FudModule rootkit indicators and unexpected kernel-driver activity now — patching afterward doesn’t undo a rootkit that’s already resident.
Vulnerability watch: a critical VMware vCenter flaw is under active exploitation across 361 hosts in 47 countries, and there’s no workaround
CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw in vCenter Server’s Syslog component disclosed in Broadcom’s July 29 advisory VMSA-2026-0006, lets an unauthenticated attacker with network access to a vulnerable vCenter instance execute arbitrary code. Researchers tracking the exploitation wave observed the first attacker-controlled connections just five days after disclosure, and the campaign has since grown to 361 distinct victim IPs spanning 47 countries. The attack chain follows path-traversal activity consistent with the flaw, then drops a malicious cron job that installs reverse_ssh — an open-source tunneling tool — to hold persistent remote access to the hypervisor management plane. Broadcom has confirmed no workaround exists; the only fix is the vendor patch, shipped in vCenter 9.1.0.0300, 9.0.2.0100, or the applicable 8.0 U3k/U2f update. The Hacker News · Cybersecurity News
vCenter compromise means hypervisor-level access to every VM it manages — this isn’t a flaw you can compensate for with segmentation alone. If you’re still on an unpatched build, treat it as an active incident-response exercise, not a maintenance window: check for unfamiliar cron entries and outbound SSH tunnels to unrecognized infrastructure on the vCenter appliance itself, in addition to applying the update.
Vulnerability watch: a Defender zero-day called ShieldBreak ships with no fix, bypassing the patch Microsoft shipped weeks ago
Researcher Nightmare Eclipse published ShieldBreak, a zero-day that abuses a user-mode callback hook in Windows Defender’s cloud-hydration scan (via the Cloud Filter API) to swap file contents mid-scan and escalate a low-privilege user to full SYSTEM access — on Windows 10, Windows 11 up to 25H2, and Windows Server 2025. Defender has to be enabled for it to work, which on most managed fleets it is. The bigger problem: ShieldBreak is a complete bypass of the patch Microsoft shipped for RoguePlanet (CVE-2026-50656), confirming the underlying weakness in the Defender engine was never fully closed. There’s no patch available as of publication. The disclosure lands amid an ongoing public dispute between the researcher and Microsoft over its handling of prior bug reports and a since-retracted legal threat against independent researchers who disclose outside Microsoft’s preferred channel. Bleeping Computer · The Register
There’s no version bump to apply here yet, so compensating controls carry the weight: watch for unexpected privilege escalation on hosts immediately following a Defender cloud-hydration scan, and don’t assume the RoguePlanet fix from last month closed this class of bug — it didn’t. Track Microsoft’s advisory for an actual patch and prioritize it once one ships.
Threat actor watch: Sandworm trojanizes WireGuard and runs fake job interviews to compromise Ukrainian system administrators
A Sandworm subcluster tracked as UAC-0145 has been running a recruiting-scam campaign against system administrators and IT professionals since at least May, contacting targets on job sites under the guise of hiring for known IT companies, then moving the conversation to Telegram and Zoom for a fake interview process. The payoff is SopraVPN, a trojanized WireGuard client that hides AES-encrypted attacker commands inside VPN configuration files rather than the binary itself — a placement that dodges file-hash and static-signature detection — and can execute arbitrary commands on the infected host. The Hacker News · Bleeping Computer
A GRU-linked group investing months in individual recruiting scams to land sysadmin-level access tells you what they think that access is worth. If IT staff have installed VPN software sourced through a job-application or interview process rather than your standard software channel, treat it as compromised and inspect the config file itself, not just the binary — that’s where this payload hides.
Also noted: Wesco confirms a cybersecurity incident after an extortion group claims 2.6 million CRM records
Global supply-chain and distribution company Wesco confirmed it’s investigating a security incident limited to its cloud CRM environment after the extortion group ExfilSquad claimed to have stolen roughly 2.6 million records — customer and employee PII, account and contact data, CRM user profiles, and authentication metadata. Wesco says it found no evidence of ransomware on its IT systems and no exposure of payment card or financial account data, and that operations have continued without disruption. Bleeping Computer · SC Media
A CRM-scoped breach is a reminder that SaaS platforms holding customer PII are as much in-scope for monitoring as your core infrastructure — authentication metadata and access logs from cloud CRM tools are worth pulling into your SIEM alongside everything else, not treated as out-of-band.
Final thought
Two of today’s items are nation-state groups investing real time in recruiting scams rather than technical exploits alone, and two are patches that didn’t fully close what they claimed to. Neither pattern is solved by a single control: the recruiting-scam items need a briefed, skeptical workforce as much as they need EDR coverage, and the incomplete-patch items need you tracking vendor advisories closely enough to know when “patched” doesn’t mean “fixed.” If you want help building the detections and workforce processes to catch both, see our how-to guides or book a discovery call.