The Same Chain, Twice: afd.sys, FudModule, and Lazarus in the KEV Catalog (2024–2026)

A Playbook, Not a Vulnerability

Most threat clusters in the KEV catalog are organised around a product. Zimbra keeps failing in its HTML sanitizer; Ivanti keeps failing at the management plane. The cluster documented here is different. It is organised around a technique — and the KEV catalog happens to have recorded the same three-stage attack chain twice, two years apart, executed by the same actor for the same purpose.

The stages are always these:

1. Get code running on the target, typically inside a sandbox — a browser renderer, or a document-handling process reached through social engineering.
2. Escalate to SYSTEM using a Windows kernel driver flaw, most often in afd.sys.
3. Install FudModule, a kernel-mode rootkit whose entire purpose is to switch off the defender's ability to see stages one and two.

In August 2024 the catalog captured all three stages within a fifteen-day window: two Chromium V8 zero-days, an afd.sys use-after-free, and the rootkit they existed to deliver. In August 2026 — with CVE-2026-68820, added to KEV on 11 August — the second and third stages repeated, in the same driver, attributed to the same group, delivering a new build of the same rootkit.

Five afd.sys CVEs have now reached KEV, four of them since August 2024. The CVE numbers keep changing. Very little else does.

Why a Socket Driver Became the Escalation Tier

afd.sys — the Ancillary Function Driver for WinSock — is the kernel-mode component underneath the Windows Sockets API. Every TCP/IP socket call from every user-mode application passes through it.

That single fact produces a set of properties an exploit developer could hardly design more favourably:

• It is everywhere. Present and loaded on every Windows installation, client and server, by default.
• It cannot be removed. Unlike a third-party driver, afd.sys cannot be uninstalled, unloaded, or blocked. There is no configuration that takes it out of the attack surface, and no "disable the vulnerable feature" workaround for a bug found in it.
• Anyone can reach it. Interacting with it requires no privilege. A standard user, a service account, or a process running inside a low-integrity sandbox can all issue the socket operations that drive its code paths.
• It is reachable from inside sandboxes. This is the decisive property. AppContainer and browser renderer sandboxes deliberately strip away almost everything — but they cannot strip away sockets, because the sandboxed code needs to talk to the network. A kernel bug reachable from inside a renderer is a sandbox escape.
• It is large and stateful. The driver tracks object lifecycles for sockets across concurrent threads. That is exactly the kind of code that produces use-after-free and race-condition bugs, and four of the five KEV entries are memory-lifecycle failures.

Put together: afd.sys is a permanently mounted, universally reachable, memory-unsafe bridge between the least-privileged code on a Windows machine and the kernel. It is not surprising that a well-resourced actor decided to invest in it as a research target — it is surprising that it took as long as it did.

The afd.sys KEV Record

Two observations are worth drawing out.

Every entry since 2024 was a zero-day. Each of the four recent afd.sys CVEs was added to KEV on the same day its patch shipped, because exploitation was already confirmed when Microsoft released the fix. There was never a patch window for any of them. Defenders did not lose a race; there was no race to enter.

Every entry scores in the sevens. CVSS treats a local privilege escalation as mid-tier: attack vector Local, privileges required Low, and — for CVE-2026-68820 — attack complexity High, because winning a race condition is probabilistic. The result is a 7.0 that ranks below a great many vulnerabilities nobody is exploiting. This is the same measurement failure the Zimbra XSS cluster exhibits from the other direction: CVSS scores a vulnerability in isolation, and these vulnerabilities are never used in isolation. Stage two of a chain is worth precisely as much as stages one and three make it worth.

FudModule: The Payload That Explains the Pattern

None of this makes sense without understanding what the escalation is for.

FudModule is a kernel-mode rootkit used by Lazarus Group, North Korea's principal state-sponsored intrusion set (also tracked as APT38, Hidden Cobra, Diamond Sleet, and Citrine Sleet across different vendors' naming). It is not a backdoor and not a payload in the usual sense — its job is to make the rest of the intrusion unobservable. Operating from the kernel, it disables ETW telemetry, removes EDR minifilter and notification callbacks, and tampers with the kernel objects that Windows security products rely on to know what is happening on the machine.

A rootkit like that needs an arbitrary kernel read/write primitive to install. That requirement is the entire reason this cluster exists: every kernel LPE in it is a means of getting FudModule into the kernel.

What makes the cluster legible as a single story is FudModule's documented evolution, which the KEV catalog tracks stage by stage:

2022–2023 — Bring Your Own Vulnerable Driver. Early FudModule deployments achieved kernel access by loading a legitimately signed but vulnerable third-party driver and exploiting it. Effective, but noisy: the load of an unexpected signed driver is a well-known detection signal, and defenders built blocklists around exactly this technique.

January 2023 — CVE-2023-21674. A use-after-free in Windows ALPC, discovered by Avast, providing sandbox escape to SYSTEM. Not afd.sys, but the same structural idea and the same research team that would document the next step.

February 2024 — CVE-2024-21338. The turning point. Jan Vojtěšek and the Avast threat research team found Lazarus exploiting an exposed IOCTL with insufficient access control in appid.sys, the Windows AppLocker driver, and dereferencing an untrusted pointer to obtain a kernel write. This was the first FudModule deployment using a genuine kernel zero-day rather than BYOVD — a real capability upgrade, because it removed the vulnerable-driver load that defenders had learned to watch for.

August 2024 — CVE-2024-38193. Six months later, the same rootkit arrived through afd.sys, found by Gen Digital. Lazarus had moved from a driver that ships with AppLocker to one that ships with everything.

August 2026 — CVE-2026-68820. Check Point Research reports Lazarus back in afd.sys, deploying a new version of FudModule.

The Complete Chain, August 2024

August 2024 is the clearest thing in the catalog: an entire nation-state attack chain, end to end, in three KEV entries added across fifteen days.

The chain reads as a direct expression of the properties described earlier. A V8 bug yields execution in the most heavily sandboxed process on the machine — which is why afd.sys is the natural next step, being one of the few kernel surfaces that sandbox still permits reaching. Microsoft attributed the Chromium exploitation to Citrine Sleet, a North Korean actor targeting cryptocurrency organisations; Gen Digital connected the kernel half to FudModule.

The targeting was consistent throughout: cryptocurrency industry and financial sector staff, matching North Korea's use of large-scale theft to fund state programmes.

The Chain Repeats, August 2026

CVE-2026-68820 was the headline actively-exploited zero-day of the August 2026 Patch Tuesday, released 11 August. It is a use-after-free in afd.sys arising from improper synchronization when multiple threads manipulate socket state concurrently: one path frees an object while another retains a stale reference. Exploitation means hammering the race until the window is hit, then grooming the kernel pool so the freed allocation is reclaimed with attacker-controlled data — yielding the kernel read/write primitive, and then SYSTEM.

Check Point Research — specifically Moshe Marelus and David Driker — reported it to Microsoft, having found it while investigating live Lazarus intrusions rather than through fuzzing. The attribution is to Operation Dream Job, Lazarus's long-running campaign of fake recruiter approaches aimed at employees of high-value firms, with targeting reported across defense, aerospace, aviation, and robotics. The purpose of the exploit, once again, was to install a new version of FudModule.

The differences from 2024 are minor and the similarities are not. Initial access shifts from browser zero-days to social engineering, and the target sectors shift from cryptocurrency toward defense and aerospace. The escalation driver, the escalation technique, the rootkit, and the actor are unchanged.

One caveat worth stating plainly: the Lazarus, Dream Job, and FudModule attributions trace to Check Point Research and are corroborated across multiple outlets, but the finer disclosure timeline circulating for this CVE — a late-July report date and an early-July exploitation start — rests on a single secondary source and has not been vendor-confirmed.

What This Cluster Tells Defenders

Patching is necessary and structurally insufficient. Four consecutive afd.sys zero-days mean the patch arrived after exploitation every time. An organisation with a flawless patch programme was still exposed during each pre-disclosure window. Patch fast anyway — but do not model this risk as though patch latency were the only variable.

Kernel integrity controls are the real mitigation. Because the target of the entire chain is kernel access, the controls that matter are the ones that make kernel access less useful:

1. Enable Virtualization-Based Security (VBS) and Hypervisor-Protected Code Integrity (HVCI). These place kernel memory integrity behind a hypervisor boundary and substantially raise the cost of rootkit installation even when an attacker holds a kernel write primitive. This is the single highest-value control against this cluster.
2. Enable the Microsoft vulnerable driver blocklist. It does not address afd.sys — nothing can — but it closes the BYOVD path FudModule used before 2024, denying the fallback.
3. Deploy EDR with kernel tamper protection and self-defence. FudModule exists specifically to disable security tooling, so a sensor's resistance to being switched off matters more here than its detection breadth.

Hunt for the effect, not the exploit. Microsoft publishes no CVE-specific IoCs for these bugs, and the exploit itself is a timing loop with no distinctive signature. What is detectable is the shape of the activity around it: anomalous handle and IOCTL traffic against \Device\Afd, especially high-rate repetition consistent with hammering a race; unexpected privilege transitions to SYSTEM from user-launched processes; kernel callback removal and other DKOM-style tampering; and — most usefully — an EDR sensor going quiet with no corresponding uninstall event. Telemetry that stops is a finding. A rootkit whose function is to create silence makes silence the indicator.

Treat detection as post-compromise triage. This is stage two of three. If CVE-2026-68820 was used against you, an initial-access stage preceded it and a rootkit followed it, and patching the driver resolves neither. Hunt backward to the Dream Job lure — DLL sideloading, malicious PDF chains, recruiter-themed archives — and forward to the kernel implant.

Prioritise by who is actually targeted. A CVSS 7.0 local privilege escalation will not survive a purely score-driven patch queue, which is precisely the failure this cluster punishes. Organisations in defense, aerospace, aviation, robotics, cryptocurrency, and finance should treat afd.sys advisories as a distinct, expedited track — the same way the Ivanti cluster argues for treating MDM patches as a countdown timer.

The Pattern Will Continue

There is no reason to expect this cluster to close. The conditions that produce it are all still in place: afd.sys remains mandatory, remains reachable from sandboxes, remains written in a memory-unsafe language, and remains large enough to hide lifecycle bugs. A capable actor has now demonstrated a repeatable pipeline for finding bugs in it, and a rootkit that pays for the effort.

What defenders can change is not the supply of afd.sys vulnerabilities but the value of exploiting one. VBS and HVCI, tamper-resistant sensors, and hunting for the silence a rootkit creates all attack the third stage rather than the second — and the third stage is the only one the attacker actually cares about.