Lazarus hackers exploited Windows zero-day to target defense firms

North Korean hackers, known as Lazarus, have been leveraging a previously unknown Windows vulnerability, designated as CVE-2026-68820, to infiltrate defense companies. This exploit is part of a broader campaign, dubbed Operation Dream Job, which targets the defense sector. The zero-day vulnerability allows attackers to gain unauthorized access to sensitive systems, posing a significant threat to national security. Microsoft has likely assigned a high severity rating to this vulnerability, given its potential for widespread exploitation. The fact that North Korean hackers are actively exploiting this vulnerability¹ underscores the need for immediate attention and patching. Defense firms and related organizations must take swift action to mitigate this threat, as the exploitation status of CVE-2026-68820 dictates whether a patch-now or monitor approach is necessary. This vulnerability's active exploitation by a nation-state actor makes it a critical concern for security practitioners, who must prioritize its remediation to prevent further breaches.