Lazarus Operation Dream Job — CVE-2026-68820

What this hunt looks for: Lazarus Operation Dream Job activity associated with CVE-2026-68820, including SecurityPDF/new.exe execution, malicious libmupdf.dll sideloading from user-writable paths, and known published file hashes.
Required logs: Microsoft Defender for Endpoint DeviceProcessEvents, DeviceImageLoadEvents, and DeviceFileEvents.

Hunt 1 — SecurityPDF / new.exe Activity

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where (FileName =~ "new.exe" and FolderPath contains "\\AppData\\Local\\Temp\\") or FileName =~ "SecurityPDF.exe"
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated asc

Hunt 2 — libmupdf.dll Sideloading From User-Writable Paths

DeviceImageLoadEvents
| where TimeGenerated >= ago(30d)
| where FileName =~ "libmupdf.dll"
| where FolderPath has_any ("\\Downloads\\", "\\Desktop\\", "\\AppData\\Local\\Temp\\")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, SHA256
| sort by TimeGenerated asc

Hunt 3 — Known Published SHA-256 Values

let LazarusHashes = dynamic([
"743172aab606974b054a64561534ae66baa3a840657f79d7c6fa18350e8d45d1",
"db3d69b7eeda2e35e23006bf4b7e206281fce809584207214fc213f9bc30376d",
"590fb6ae19480d694e08ee85859cad8066f2f87e7e5abba2960c6d115e1615d6",
"68d4fba7b1300a59cd6212c08910a260cd71b40cd9f51cac933030a68faac0bb",
"a738059ce07c951c31ab2da3d93d8f69bff32f9b7d933dbf5943441b9cc99075"
]);
DeviceFileEvents
| where TimeGenerated >= ago(90d)
| where SHA256 in (LazarusHashes)
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine