North Korea’s Lazarus Group is running a new wave of Operation Dream Job against defense, aerospace, and aviation organizations in Europe, India, Brazil, and Western Europe, using fake recruiter outreach and trojanized PDF tools to gain access and deploy advanced malware. Victims are approached with compelling job offers (at firms like Lockheed Martin or Enveil) and lured into opening malicious PDFs or installing a “SecurityPDF” viewer from fake Enveil-branded sites. The infection chain uses MISTPEN, an in-memory downloader that talks to attacker-controlled OneDrive files via Microsoft Graph API, then pulls a Windows zero-day exploit, CVE-2026-68820 (a use-after-free in AFD.sys) to gain SYSTEM privileges. That exploit is negotiated over a post quantum ML KEM (Kyber) key exchange and additional GOST/AES layers, delivering FudModule 3.1, a kernel rootkit that disables EDR telemetry, blinds ETW, and tampers with Smart App Control. Once elevated, Lazarus deploys Troy, a new backdoor with seventeen (17) commands for reconnaissance, file exfiltration, hidden command execution, process killing, in memory DLL injection, and configuration changes. For command-and-control (C2), the group largely uses “borrowed” infrastructure, including compromised Roundcube servers exploited via CVE 2025 49113 and PrestaShop sites, all running a PHP relay webshell called RelayShell. At least seventeen (17) relay servers have been identified. The campaign heavily targets firms working on surveillance sensors, drones, and robotics, and demonstrates Lazarus’s continued evolution toward stealthy, environment aware operations that hide behind trusted branding, top ranked search results, and legitimate web infrastructure, this making traditional “spot the phishing link” advice far less effective.